Internet Bug Bounty · Report #2585373

moderate: Apache HTTP Server: HTTP response splitting (CVE-2023-38709)

Validstatus

mediumseverity

$2,600bounty

19upvotes

13 Jul 2024disclosed

Summary

moderate: Apache HTTP Server: HTTP response splitting (CVE-2023-38709)

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.

This issue affects Apache HTTP Server: through 2.4.58.

Acknowledgements: finder: Orange Tsai (@orange_8361) from DEVCORE

Reported to security team: 2023-06-26 Update 2.4.59 released: 2024-04-04 Affects: through 2.4.58

How it was found

I reported this vulnerability through the official Apache HTTP Server security email on April 1, 2024, and received a fix along with a CVE number on July 1, 2024. You can check detailed information from there:

https://httpd.apache.org/security/vulnerabilities_24.html

Impact

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.

This issue affects Apache HTTP Server: through 2.4.58.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original