CVE-2013-1862
published 2013-06-10CVE-2013-1862: mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters…
PriorityP344medium5.1CVSS 2.0
AVNACHAuNCPIPAP
EPSS
24.89%
97.7th percentile
mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.0.0 < 2.0.65 | 2.0.65 |
| apache | http_server | >= 2.2.0 < 2.2.25 | 2.2.25 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | apache2 | < apache2 2.4.1-1 (bookworm) | apache2 2.4.1-1 (bookworm) |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| oracle | http_server | — | — |
| oracle | http_server | — | — |
| oracle | http_server | — | — |
| oracle | http_server | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | jboss_enterprise_application_platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP requests containing terminal escape sequences (e.g., ESC [ sequences) targeting Apache mod_rewrite, which may be injected to manipulate log files viewed in a terminal emulator. ↗
- →Monitor Apache RewriteLog files for non-printable or terminal escape sequence characters written by mod_rewrite's do_rewritelog() function, indicating potential exploitation attempts. ↗
- →The vulnerability is triggered via crafted HTTP requests processed by the do_rewritelog() function in mod_rewrite; monitor for anomalous non-printable characters in HTTP request URIs or headers on Apache 2.2.x before 2.2.25. ↗
- →Review the upstream patch at the Apache SVN revision r1469311 to understand the exact sanitization fix applied to mod_rewrite.c, and use it to build targeted detection logic. ↗
- ·The vulnerability is only exploitable if the RewriteLog directive is enabled in the Apache mod_rewrite configuration; without active rewrite logging, escape sequences cannot be written to log files. ↗
- ·Exploitation requires a user to view the tampered log file in a terminal emulator for arbitrary command execution to occur; the initial injection alone does not execute commands. ↗
- ·In typical network configurations, the attacker likely needs access to trusted internal networks to submit crafted requests, reducing the likelihood of successful remote exploitation. ↗
CVSS provenance
nvdv2.05.1MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
osv5.1MEDIUM
vendor_cisco5.1MEDIUM
vendor_debian5.1LOW
vendor_redhat5.1MEDIUM
vendor_ubuntu5.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2013-07-15·CVSS 5.1
CVE-2013-1862 [MEDIUM] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in the Apache HTTP Server.
It was discovered that the mod_rewrite module incorrectly sanitized non-
printable characters before writing data to log files. A remote attacker
could possibly use this flaw to execute arbitrary commands by injecting
escape sequences in the log file. (CVE-2013-1862)
It was discovered that the mod_dav module incorrectly handled certain MERGE
requests. A remote attacker could use this issue to cause the server to
stop responding, resulting in a denial of service. (CVE-2013-1896)
Instructions: In general, a standard system update will make all the necessary changes.
Cisco
Apache HTTP Server mod_rewrite Log File Manipulation Vulnerability
vendor_cisco·2013-05-30·CVSS 5.1
CVE-2013-1862 [MEDIUM] CWE-20 Apache HTTP Server mod_rewrite Log File Manipulation Vulnerability
Apache HTTP Server mod_rewrite Log File Manipulation Vulnerability
A vulnerability in the do_rewritelog() function of Apache HTTP Server could allow an unauthenticated, remote attacker to gain access to sensitive information.
The vulnerability is due to improper handling of certain escape sequences by the affected software. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted HTTP request to the targeted device. Processing the crafted request could allow certain escape sequences to be written to the log file. If an attacker views these sequences in the log file with a terminal emulator, the attacker could execute arbitrary commands on the targeted system.
Apache has confirmed this vulnerability and released updated software.
To exploit the vulnerab
Red Hat
httpd: mod_rewrite allows terminal escape sequences to be written to the log file
vendor_redhat·2013-04-19·CVSS 5.1
CVE-2013-1862 [MEDIUM] httpd: mod_rewrite allows terminal escape sequences to be written to the log file
httpd: mod_rewrite allows terminal escape sequences to be written to the log file
mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
Package: httpd (Red Hat Enterprise Linux 4) - Affected
Package: httpd (Red Hat JBoss Enterprise Web Server 1) - Will not fix
Debian
CVE-2013-1862: apache2 - mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2...
vendor_debian·2013·CVSS 5.1
CVE-2013-1862 [MEDIUM] CVE-2013-1862: apache2 - mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2...
mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
Scope: local
bookworm: resolved (fixed in 2.4.1-1)
bullseye: resolved (fixed in 2.4.1-1)
forky: resolved (fixed in 2.4.1-1)
sid: resolved (fixed in 2.4.1-1)
trixie: resolved (fixed in 2.4.1-1)
GHSA
GHSA-wp7w-p549-c3xq: mod_rewrite
ghsa_unreviewed·2022-05-13
CVE-2013-1862 [MEDIUM] GHSA-wp7w-p549-c3xq: mod_rewrite
mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
OSV
CVE-2013-1862: mod_rewrite
osv·2013-06-10·CVSS 5.1
CVE-2013-1862 [MEDIUM] CVE-2013-1862: mod_rewrite
mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
No detection rules found.
No public exploits indexed.
HackerOne
Out-of-date Version (Apache)
hackerone·2019-12-02·CVSS 5.0
[MEDIUM] Out-of-date Version (Apache)
Out-of-date Version (Apache)
URL https://████████/
Identified Version 2.2.15 (contains 4 important and 10 other vulnerabilities)
Latest Version 2.2.31
Vulnerability Database Result is based on 27.10.2016 vulnerability database content.
Vulnerability Details
Link identified you are using an out-of-date version of Apache.
Impact
Since this is an old version of the software, it may be vulnerable to attacks.
Remedy
Please upgrade your installation of Apache to the latest stable version.
Remedy References
•Downloading the Apache HTTP Server
Known Vulnerabilities in this Version
Medium Apache mod_cache and mod_dav Request Handling Denial of Service Vulnerability
The mod_cache and mod_dav modules in the Apache HTTP Server allow remote attackers to cause a denial of service (process
Bugzilla
CVE-2013-1862 httpd: mod_rewrite allows terminal escape sequences to be written to the log file
bugzilla·2013-04-19·CVSS 5.1
CVE-2013-1862 [MEDIUM] CVE-2013-1862 httpd: mod_rewrite allows terminal escape sequences to be written to the log file
CVE-2013-1862 httpd: mod_rewrite allows terminal escape sequences to be written to the log file
It was found that mod_rewrite writes data to a log file without sanitizing non-printable characters. A remote attacker could use this flaw to write terminal escape sequences to log files (if the RewriteLog directive was used by mod_rewrite). This could possibly cause arbitrary command execution, via HTTP requests containing an escape sequence for a terminal emulator. (if for example the log files were viewed in a terminal emulator)
Reference:
http://svn.apache.org/viewvc?view=revision&revision=r1469311
Proposed patch:
http://people.apache.org/~jorton/mod_rewrite-CVE-2013-1862.patch
Discussion:
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Red Hat Enterpris
http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.htmlhttp://lists.opensuse.org/opensuse-updates/2013-08/msg00029.htmlhttp://lists.opensuse.org/opensuse-updates/2013-08/msg00030.htmlhttp://people.apache.org/~jorton/mod_rewrite-CVE-2013-1862.patchhttp://rhn.redhat.com/errata/RHSA-2013-0815.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1207.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1208.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1209.htmlhttp://secunia.com/advisories/55032http://support.apple.com/kb/HT6150http://svn.apache.org/viewvc?view=revision&revision=r1469311http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1862http://www-01.ibm.com/support/docview.wss?uid=swg21644047http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2013:174http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlhttp://www.securityfocus.com/bid/59826http://www.securityfocus.com/bid/64758http://www.ubuntu.com/usn/USN-1903-1https://bugzilla.redhat.com/show_bug.cgi?id=953729https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetokenhttps://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18790https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19534http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.htmlhttp://lists.opensuse.org/opensuse-updates/2013-08/msg00029.htmlhttp://lists.opensuse.org/opensuse-updates/2013-08/msg00030.htmlhttp://people.apache.org/~jorton/mod_rewrite-CVE-2013-1862.patchhttp://rhn.redhat.com/errata/RHSA-2013-0815.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1207.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1208.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1209.htmlhttp://secunia.com/advisories/55032http://support.apple.com/kb/HT6150http://svn.apache.org/viewvc?view=revision&revision=r1469311http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1862http://www-01.ibm.com/support/docview.wss?uid=swg21644047http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2013:174http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlhttp://www.securityfocus.com/bid/59826http://www.securityfocus.com/bid/64758http://www.ubuntu.com/usn/USN-1903-1https://bugzilla.redhat.com/show_bug.cgi?id=953729https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetokenhttps://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18790https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19534
2013-06-10
Published