Target Industry

Indiscriminate, opportunistic targeting.

Overview

A critical vulnerability has been identified in the Apache HTTP Server, tracked as CVE-2023-25690, with a CVSS score of 9.8. This vulnerability allows for HTTP Request Smuggling attacks, which exploit inconsistencies in how web servers process sequences of HTTP requests, enabling threat actors to bypass security controls and gain unauthorised access to sensitive data. 

Impact

The exploitation of CVE-2023-25690 can lead to significant impacts including unauthorised access to sensitive data, bypassing of access controls, and cache poisoning. Organisations may even face financial losses due to operational downtime, costs associated with incident response, and potential regulatory fines. 

Affected Products

• Apache HTTP Server versions 2.4.0 – 2.4.55 

Exploitation

Exploitation of CVE-2023-25690 involves crafting HTTP requests that leverage the vulnerability in mod_proxy configurations. Threat actors can use tools like curl to send specially formatted requests that exploit the RewriteRule or ProxyPassMatch configurations, allowing them to smuggle additional requests through the proxy. A proof of concept is available on GitHub.  

Containment, Mitigations & Remediations

To mitigate the risks associated with CVE-2025-20188, it is highly recommended for organisations to take the following steps:  

• Upgrade to the latest version of Apache HTTP Server 

• Review and modify mod_proxy configurations to avoid using non-specific patterns in RewriteRule or ProxyPassMatch directives – crucial 

• Regularly monitor and update systems to ensure they are patched against known vulnerabilities. 

Threat Landscape

The threat landscape for CVE-2023-25690 is characterised by a high number of potentially vulnerable servers, with over 6 million identified globally. The US has the highest concentration of affected servers, followed by countries like Germany and the UK. This widespread vulnerability presents a significant risk for organisations, particularly those relying on Apache HTTP Server for critical operations. 

Threat Group

At the time of writing, there are no threat groups associated with CVE-2023-25690. 

Further Information

Apache HTTP Server Project page