CVE-2025-54090
📋 TL;DR
A bug in Apache HTTP Server 2.4.64 causes all RewriteCond expression tests to evaluate as true, potentially allowing attackers to bypass URL rewrite rules and access restricted content. This affects all systems running Apache HTTP Server 2.4.64 with mod_rewrite enabled. The vulnerability could lead to unintended URL redirection or access control bypass.
💻 Affected Systems
- Apache HTTP Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass authentication, access control, or security filters by manipulating URL rewrite conditions to access restricted directories, sensitive files, or administrative interfaces.
Likely Case
Attackers bypass URL-based security restrictions to access content that should be blocked, potentially exposing sensitive information or enabling further attacks.
If Mitigated
With proper network segmentation and additional authentication layers, impact is limited to potential information disclosure from misconfigured rewrite rules.
🎯 Exploit Status
Exploitation requires knowledge of existing rewrite rules and crafting requests that trigger the bug. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.65
Vendor Advisory: https://httpd.apache.org/security/vulnerabilities_24.html
Restart Required: Yes
Instructions:
1. Download Apache HTTP Server 2.4.65 from official Apache mirrors. 2. Stop Apache service. 3. Backup current configuration. 4. Install new version. 5. Restart Apache service.
🔧 Temporary Workarounds
Disable mod_rewrite
allTemporarily disable the mod_rewrite module to prevent exploitation
# Comment out LoadModule rewrite_module modules/mod_rewrite.so in httpd.conf
# Or run: a2dismod rewrite && systemctl restart apache2
Remove RewriteCond expressions
allTemporarily remove or comment out all RewriteCond directives in configuration files
# Comment out lines starting with RewriteCond in .htaccess and httpd.conf files
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block suspicious URL patterns that might exploit rewrite bypass
- Add additional authentication/authorization layers for sensitive directories that rely on rewrite rules for protection
🔍 How to Verify
Check if Vulnerable:
Check Apache version with 'httpd -v' or 'apache2 -v'. If version is 2.4.64 and mod_rewrite is enabled with RewriteCond rules, system is vulnerable.Check Version:
httpd -v 2>/dev/null || apache2 -v 2>/dev/null || apachectl -v 2>/dev/nullVerify Fix Applied:
After upgrade, verify version is 2.4.65 with 'httpd -v' and test that RewriteCond expressions work correctly by creating test rewrite rules.📡 Detection & Monitoring
Log Indicators:
- Unusual access to URLs that should be blocked by rewrite rules
- Patterns of requests that trigger rewrite conditions but access restricted content
Network Indicators:
- HTTP requests that bypass expected URL patterns
- Access to paths that should be redirected or blocked
SIEM Query:
source="apache_access" AND (url="*" AND NOT url="expected_pattern*") | stats count by src_ip, url