---
title: "Apache httpd CVE-2024-38475: mod_rewrite Flaw Hit SMA100"
url: https://erroneo.us/security/briefs/apache-httpd-cve-2024-38475-mod-rewrite-escaping/
description: "A mod_rewrite flaw fixed in Apache httpd 2.4.60 was exploited via SonicWall SMA100 appliances. Stock httpd is exposed only with certain rewrite rules."
type: security-brief
section: "Security Digest"
date_published: 2024-07-01
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-38475"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Apache httpd CVE-2024-38475: mod_rewrite Flaw Hit SMA100

**Verdict: Check exposure.** For ordinary Apache servers this only matters if a server-level RewriteRule starts its target with a backreference or variable, and 2.4.60+ fixes it; the real-world damage was on SonicWall SMA100 appliances, which are now unsupported and should be retired and investigated.

- **Who must act:** Owners of SonicWall SMA 100 appliances, and admins of Apache 2.4.59 or earlier whose server or virtual-host config has RewriteRule substitutions beginning with $1, /$1 or %{...}.
- **Who can relax:** Apache servers on 2.4.60 or later (or a distro build with the fix), and servers whose rewrite rules all start the substitution with a fixed path.
- **Affected:** Apache HTTP Server 2.4.0 through 2.4.59 with affected server-context RewriteRules; SonicWall SMA 100 Series (SMA 200, 210, 400, 410, 500v) 10.2.1.13-72sv and earlier
- **Fixed:** Apache HTTP Server 2.4.60 (Jul 1, 2024); current release 2.4.69 (Oct 1, 2026); SonicWall SMA 100 firmware 10.2.1.14-75sv (Dec 4, 2024); the product reached end of support Nov 1, 2025
- **CVEs:** CVE-2024-38475
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check each Apache build with httpd -v or apache2 -v and upgrade to a current 2.4.x release or your distribution's patched package.
2. Review RewriteRule lines in server and virtual-host config; constrain any rule whose substitution begins with a backreference or variable, and only add the UnsafePrefixStat flag after that.
3. Ask vendors of appliances that embed Apache httpd whether their firmware includes the fix.
4. Retire SonicWall SMA 100 appliances; SonicWall ended support on November 1, 2025.
5. Before retiring an SMA 100, image it, then reset every user password and OTP binding it held and reissue certificates whose keys lived on it.

### How to check if you are affected

- On SMA 100 disk images, check whether /etc/ld.so.preload has content and look for libsamba-errors.so.6, which GTIG ties to the OVERSTEP rootkit.
- Search SMA 100 and proxy logs for admin VPN sessions from unexpected IPs and for URLs containing dobackshell or dopasswords.
- On general Apache servers, review access logs for requests carrying an encoded question mark (%3F) on rewritten URLs that returned files you do not expect to serve.
- Look for unexpected 'Current settings exported/imported' or 'Clear all logs manually' entries on SMA 100 appliances.

## What happened

On July 1, 2024, Apache HTTP Server 2.4.60 fixed CVE-2024-38475, one of several bugs Orange Tsai of DEVCORE reported on April 1 and later presented as "[Confusion Attacks](https://devco.re/blog/2024/08/09/confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-en/)." Per [Apache's advisory](https://httpd.apache.org/security/vulnerabilities_24.html), improper escaping in `mod_rewrite` lets an attacker map URLs to files the server may serve but that no URL is meant to reach. The result can be source code disclosure or code execution. Apache rates it "important." [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-38475) and CISA score it CVSS 3.1 9.1.

The exploitation came through SonicWall's SMA 100 VPN appliances, which bundle Apache with a vulnerable rewrite rule. SonicWall fixed it in firmware 10.2.1.14-75sv on December 4, 2024, under [SNWLID-2024-0018](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018). On April 29, 2025, it added that the bug could enable session hijacking and was "potentially being exploited in the wild." On May 1, [watchTowr](https://labs.watchtowr.com/sonicboom-from-stolen-tokens-to-remote-shells-sonicwall-sma100-cve-2023-44221-cve-2024-38475/) showed the bug leaking an active admin session, then chained with authenticated command injection [CVE-2023-44221](https://www.cve.org/CVERecord?id=CVE-2023-44221) to run commands. CISA added both to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38475) that day, as [The Hacker News](https://thehackernews.com/2025/05/sonicwall-confirms-active-exploitation.html) reported. In July 2025, [Google's GTIG](https://cloud.google.com/blog/topics/threat-intelligence/sonicwall-secure-mobile-access-exploitation-overstep-backdoor) described UNC6148 planting the OVERSTEP rootkit on SMA 100s with stolen admin credentials. It named this CVE as a likely source of those credentials and OTP seeds, though Mandiant could not confirm it.

## Who is affected

Apache 2.4.0 through 2.4.59, but only with a specific configuration. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-38475) limits it to "substitutions in server context that use backreferences or variables as the first segment of the substitution." A default install has no such rule. The risk comes from custom configs and from appliances that embed httpd. The fix breaks some unsafe rules, and Apache provides the `UnsafePrefixStat` flag to opt back in once a rule is constrained. On SonicWall, SMA 200, 210, 400, 410 and 500v up to 10.2.1.13-72sv are affected. SonicWall says SMA 100 reached [end of support](https://www.sonicwall.com/support/knowledge-base/sma100-firmware-release-10-2-2-4-to-support-license-manager-upgrades/kA1VN0000018XKn0AM) on November 1, 2025.

## Do you really need to act?

For most Apache admins, no urgent action is needed. 2.4.60 is more than two years old, and the current release is 2.4.69. Confirm your version and audit your rewrite rules once. For SMA 100 owners, yes. The devices are unsupported, and GTIG warns that credentials and OTP seeds stolen before patching still work afterwards.

## What to do now

1. Run `httpd -v` or `apache2 -v` and upgrade, or confirm your distribution's package carries the fix.
2. List rules with `grep -rn RewriteRule /etc/httpd /etc/apache2`. Constrain any server-level rule whose target begins with `$1`, `/$1` or `%{...}`.
3. Ask appliance vendors whether their embedded httpd is fixed.
4. Retire SMA 100s. First image them, then reset every password and OTP binding they held.

## How to tell if you were hit

On SMA 100 disk images, check whether `/etc/ld.so.preload` has content and look for `libsamba-errors.so.6`. Search logs for admin VPN sessions from unexpected IPs and for URLs containing `dobackshell` or `dopasswords`. On ordinary Apache servers, review access logs for an encoded `%3F` on rewritten URLs that returned files you never meant to serve.

## Timeline

- Apr 1, 2024 — Orange Tsai reports the bug to Apache.
- Jul 1, 2024 — Apache 2.4.60 ships the fix.
- Dec 4, 2024 — SonicWall releases SMA 100 firmware 10.2.1.14-75sv.
- Apr 29, 2025 — SonicWall warns of possible exploitation.
- May 1, 2025 — watchTowr publishes the chain, and CISA adds both CVEs to KEV.
- Jul 16, 2025 — GTIG reports the OVERSTEP campaign.
- Nov 1, 2025 — SMA 100 reaches end of support.

## Sources

1. [Apache HTTP Server — Apache HTTP Server 2.4 vulnerabilities](https://httpd.apache.org/security/vulnerabilities_24.html)
2. [CVE record — CVE-2024-38475](https://www.cve.org/CVERecord?id=CVE-2024-38475)
3. [NVD — CVE-2024-38475](https://nvd.nist.gov/vuln/detail/CVE-2024-38475)
4. [CISA — Known Exploited Vulnerabilities: CVE-2024-38475](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38475)
5. [SonicWall PSIRT — SNWLID-2024-0018: SonicWall SMA100 SSL-VPN Affected By Multiple Vulnerabilities](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018)
6. [DEVCORE (Orange Tsai) — Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server](https://devco.re/blog/2024/08/09/confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-en/)
7. [watchTowr Labs — SonicBoom, From Stolen Tokens to Remote Shells - SonicWall SMA (CVE-2023-44221, CVE-2024-38475)](https://labs.watchtowr.com/sonicboom-from-stolen-tokens-to-remote-shells-sonicwall-sma100-cve-2023-44221-cve-2024-38475/)
8. [Google Threat Intelligence Group — Ongoing SonicWall SMA Exploitation Campaign using the OVERSTEP Backdoor](https://cloud.google.com/blog/topics/threat-intelligence/sonicwall-secure-mobile-access-exploitation-overstep-backdoor)
9. [SonicWall — SMA100: 10.2.2.4 Released to Support License Manager Upgrades (end-of-support notice)](https://www.sonicwall.com/support/knowledge-base/sma100-firmware-release-10-2-2-4-to-support-license-manager-upgrades/kA1VN0000018XKn0AM)
10. [CVE record — CVE-2023-44221](https://www.cve.org/CVERecord?id=CVE-2023-44221)
11. [The Hacker News — SonicWall Confirms Active Exploitation of Flaws Affecting Multiple Appliance Models](https://thehackernews.com/2025/05/sonicwall-confirms-active-exploitation.html)

---
Source page: https://erroneo.us/security/briefs/apache-httpd-cve-2024-38475-mod-rewrite-escaping/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt