^{CVE-2023-25690:}HTTP Request Smuggling vulnerability in Apache HTTP Server mod_proxy configurations (versions 2.4.0-2.4.55)

Overview

This vulnerability (CVE-2023-25690) affects Apache HTTP Server installations that use mod_proxy in combination with URL rewriting functionality. The issue occurs specifically in configurations where user-controlled input from URLs is captured using pattern matching and then reused in the construction of the backend request. For example, configurations using RewriteRule with the [P] flag or ProxyPassMatch directives that capture and reuse parts of the request URL are vulnerable.

The request smuggling vulnerability can allow attackers to manipulate how requests are interpreted by the proxy and backend servers. In affected configurations, an attacker could craft special requests that, when processed by the vulnerable Apache server, result in unexpected request splitting when forwarded to backend servers. This can lead to security bypasses, accessing unauthorized content, or poisoning web caches with malicious content.

Remediation

To address this vulnerability, take the following actions:

1. Update Apache HTTP Server to version 2.4.56 or later, which contains a fix for this vulnerability.

2. If immediate updating is not possible, review and modify any mod_proxy configurations that:

   • Use RewriteRule with the [P] flag
   • Use ProxyPassMatch directives
   • Capture user input with patterns and reuse it in the target URL

3. When using URL rewriting with proxying, implement stricter pattern matching that specifically validates user input before reusing it in proxy destinations.

4. Consider implementing additional security controls such as a Web Application Firewall (WAF) that can detect and block HTTP request smuggling attempts.

5. Regularly audit proxy configurations for potential security issues, especially those that handle user-supplied input.

References

1. Apache HTTP Server Security Vulnerabilities: https://httpd.apache.org/security/vulnerabilities_24.html
2. Packet Storm Security - Apache 2.4.55 mod_proxy HTTP Request Smuggling: http://packetstormsecurity.com/files/176334/Apache-2.4.55-mod_proxy-HTTP-Request-Smuggling.html
3. Debian Security Advisory: https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html
4. Gentoo Security Advisory: https://security.gentoo.org/glsa/202309-01