AI analysis
Apache HTTP Server 2.4.60 through 2.4.68 has a deployment-of-wrong-handler flaw (CWE-430) in how some internal redirects issued by CGI programs are handled. If the redirect target is already inside a directory enabled for CGI and has no filename extension that mod_mime understands, the server may treat that non-CGI file as CGI and execute it. An attacker who can influence such a redirect could gain limited unintended execution, with integrity impact only; the issue is rated CVSS 3.1 3.7 (network, high attack complexity, no privileges or user interaction). Only operators of those versions who actually use CGI are in scope; hosts without CGI-enabled directories are not exposed. No public proof of concept is known and the flaw is not in the CISA KEV catalog.
What to do: Upgrade Apache HTTP Server to a release newer than 2.4.68. Until then, do not place non-CGI files in CGI-enabled directories (for example ScriptAlias), and ensure any files there use extensions mod_mime already understands. Review CGI programs that perform internal redirects.
Affected
| Apache Software Foundation Apache HTTP Server | 2.4.60 through 2.4.68 |
Estimated exposure
massOn the order of 100,000 to low millions of servers run 2.4.60–2.4.68; far fewer are exploitable because CGI directories are required — Public web surveys and internet scans consistently show Apache HTTP Server on millions of sites; the 2.4.60–2.4.68 window is only a recent slice of that base (many distributions lag upstream), and actual exploitation further requires a…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime. This issue affects Apache HTTP Server: from 2.4.60 through 2.4.68.