Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
Apache Software Foundation · Apache HTTP Server
The Apache HTTP Server (Apache Software Foundation) contains an HTTP request smuggling flaw in some mod_proxy configurations, where a non-specific RewriteRule or ProxyPassMatch pattern lets user-supplied request-target data be re-inserted into the proxied request via variable substitution. An attacker able to send crafted HTTP requests can exploit this, with no authentication or user interaction required, when mod_proxy is enabled alongside such a rule, to split or smuggle requests and thereby bypass proxy access controls, reach unintended URLs on origin servers, or poison caches.
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 17 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 49 days after disclosure.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+49 days
- First seen exploitedVulnCheck KEV evidence+17 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 16 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Update 10: Cybercriminals Leverage 66 Vulnerabilities to Target Global Systems2 Jul 2025
- Veriti Research Uncovers Malware Exploiting Cloud Services - VERITI11 Mar 2025
- NCSC Advisory - 18th Sept 2024 - PRC Botnet14 Jan 2025
- People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations7 Jan 2025
- People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations7 Jan 2025
- People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations2 Oct 2024
- 10 more on OTX