Internet Bug Bounty · Report #2585375

important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)

Validstatus

highseverity

$4,920bounty

27upvotes

13 Jul 2024disclosed

Summary

important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)

null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.

Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Acknowledgements: finder: Orange Tsai (@orange_8361) from DEVCORE

Reported: 2024-04-01 fixed by r1918607 in 2.4.x: 2024-07-01 Update 2.4.60 released: 2024-07-01 Affects: 2.4.0 through 2.4.59

How it was found

I reported this vulnerability through the official Apache HTTP Server security email on April 1, 2024, and received a fix along with a CVE number on July 1, 2024. You can check detailed information from there:

https://httpd.apache.org/security/vulnerabilities_24.html

Impact

null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.

Users are recommended to upgrade to version 2.4.60, which fixes this issue.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original