CVE-2024-38475
published 2024-07-01CVE-2024-38475: Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted…
PriorityP196critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2025-05-22
Exploited in the wild
EPSS
99.96%
100.0th percentile
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.
Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.4.0 < 2.4.60 | 2.4.60 |
| apache_software_foundation | apache_http_server | 2.4.0 – 2.4.59 | — |
| debian | apache2 | < apache2 2.4.61-1~deb12u1 (bookworm) | apache2 2.4.61-1~deb12u1 (bookworm) |
| paloalto | pan-os | — | — |
| sonicwall | sma_200_firmware | < 10.2.1.14-75sv | 10.2.1.14-75sv |
| sonicwall | sma_210_firmware | < 10.2.1.14-75sv | 10.2.1.14-75sv |
| sonicwall | sma_400_firmware | < 10.2.1.14-75sv | 10.2.1.14-75sv |
| sonicwall | sma_410_firmware | < 10.2.1.14-75sv | 10.2.1.14-75sv |
| sonicwall | sma_500v_firmware | < 10.2.1.14-75sv | 10.2.1.14-75sv |
Detection & IOCsextracted from sources · hover to see the quote
url{{BaseURL}}/tmp/temp.db%3f.1.1.1.1a-1.css
url{{BaseURL}}/mnt/ram/var/log/httpd.log%3f.1.1.1.1a-1.css
path/tmp/temp.db
path/mnt/ram/var/log/httpd.log
- →Exploit pattern uses URL-encoded '?' (%3f) to truncate file path in mod_rewrite — look for GET requests containing '%3f' followed by a crafted extension (e.g., '.css', '.png') targeting sensitive file paths on SonicWall SMA100 devices. ↗
- →Detection of successful exploitation: HTTP 200 response body containing both 'SQLite format' and 'sessionId' strings indicates successful read of the SMA100 session database (temp.db).
- →Detection of successful exploitation via log file read: HTTP 200 response body containing both 'mod_antiloris' and '[pid' strings with content-type 'text/plain' indicates successful read of httpd.log.
- →CVE-2024-38475 on SonicWall SMA100 can enable session hijacking — monitor for unauthorized reuse of stolen session tokens following file-read exploitation. ↗
- →Shodan query to identify exposed SonicWall SMA100 targets: html:"SonicWall" html:"SMA"
- →Post-exploitation: OVERSTEP rootkit is deployed as a .ELF binary decoded from base64; hunt for unexpected ELF binaries written to disk on SMA appliances, especially following base64 decode commands in shell history. ↗
- →Threat actor UNC6148 manually cleared system logs before restarting the appliance — absence of expected log entries or log gaps on SMA100 devices should be treated as a compromise indicator. ↗
- ·The 'UnsafePrefixStat' rewrite flag can be used to opt back in to pre-fix behavior for RewriteRules broken by the patch — ensure any use of this flag is accompanied by appropriate input constraints, as it re-enables the vulnerable behavior. ↗
- ·Vulnerability affects SonicWall SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v devices; patched in firmware version 10.2.1.14-75sv and later. Exploitation was confirmed against devices not yet updated to 10.2.1.15-81sv. ↗
- ·GTIG assesses with high confidence that UNC6148 exploited CVE-2024-38475 to steal administrator credentials prior to the targeted SMA appliance being updated to the latest firmware, but Mandiant incident responders could not confirm exploitation of this specific CVE. ↗
- ·OVERSTEP's anti-forensic and rootkit capabilities (selective log deletion, hiding components) mean standard log-based detection may be insufficient; disk image acquisition is recommended to avoid rootkit interference during forensic analysis. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
osv9.8CRITICAL
vulncheck9.1CRITICAL
cisa9.1CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian9.1CRITICAL
vendor_redhat9.1CRITICAL
vendor_oracle8.2CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
apache2 vulnerabilities
osv·2025-07-21·CVSS 9.8
[CRITICAL] apache2 vulnerabilities
apache2 vulnerabilities
USN-6885-1 fixed vulnerabilities in Apache. This update provides
the corresponding updates for Ubuntu 14.04 LTS.
Original advisory details:
Orange Tsai discovered that the Apache HTTP Server mod_rewrite module
incorrectly handled certain substitutions. A remote attacker could
possibly use this issue to execute scripts in directories not directly
reachable by any URL, or cause a denial of service. Some environments
may require using the new UnsafeAllow3F flag to handle unsafe
substitutions. (CVE-2024-38474, CVE-2024-38475)
OSV
apache2 vulnerabilities
osv·2024-09-18·CVSS 9.8
[CRITICAL] apache2 vulnerabilities
apache2 vulnerabilities
USN-6885-1 fixed several vulnerabilities in Apache. This update provides
the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
Orange Tsai discovered that the Apache HTTP Server mod_rewrite module
incorrectly handled certain substitutions. A remote attacker could
possibly use this issue to execute scripts in directories not directly
reachable by any URL, or cause a denial of service. Some environments
may require using the new UnsafeAllow3F flag to handle unsafe
substitutions. (CVE-2024-38474, CVE-2024-38475)
Orange Tsai discovered that the Apache HTTP Server incorrectly handled
certain response headers. A remote attacker could possibly use this issue
to obtain sensitive information, execute local scripts, or perform SSRF
OSV
apache2 regression
osv·2024-07-11·CVSS 5.4
[MEDIUM] apache2 regression
apache2 regression
USN-6885-1 fixed vulnerabilities in Apache HTTP Server. One of the security
fixes introduced a regression when proxying requests to a HTTP/2 server.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Marc Stern discovered that the Apache HTTP Server incorrectly handled
serving WebSocket protocol upgrades over HTTP/2 connections. A remote
attacker could possibly use this issue to cause the server to crash,
resulting in a denial of service. (CVE-2024-36387)
Orange Tsai discovered that the Apache HTTP Server mod_proxy module
incorrectly sent certain request URLs with incorrect encodings to backends.
A remote attacker could possibly use this issue to bypass authentication.
(CVE-2024-38473)
Orange Tsai discovered that the Apach
OSV
apache2 vulnerabilities
osv·2024-07-08·CVSS 5.4
CVE-2024-36387 [MEDIUM] apache2 vulnerabilities
apache2 vulnerabilities
Marc Stern discovered that the Apache HTTP Server incorrectly handled
serving WebSocket protocol upgrades over HTTP/2 connections. A remote
attacker could possibly use this issue to cause the server to crash,
resulting in a denial of service. (CVE-2024-36387)
Orange Tsai discovered that the Apache HTTP Server mod_proxy module
incorrectly sent certain request URLs with incorrect encodings to backends.
A remote attacker could possibly use this issue to bypass authentication.
(CVE-2024-38473)
Orange Tsai discovered that the Apache HTTP Server mod_rewrite module
incorrectly handled certain substitutions. A remote attacker could possibly
use this issue to execute scripts in directories not directly reachable
by any URL, or cause a denial of service. Some environments
GHSA
GHSA-pf44-j75v-mhr8: Improper escaping of output in mod_rewrite in Apache HTTP Server 2
ghsa_unreviewed·2024-07-01
CVE-2024-38475 [CRITICAL] CWE-116 GHSA-pf44-j75v-mhr8: Improper escaping of output in mod_rewrite in Apache HTTP Server 2
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.
Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
OSV
CVE-2024-38475: Improper escaping of output in mod_rewrite in Apache HTTP Server 2
osv·2024-07-01·CVSS 9.1
CVE-2024-38475 [CRITICAL] CVE-2024-38475: Improper escaping of output in mod_rewrite in Apache HTTP Server 2
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.
Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
OSV
CVE-2024-38475: Improper escaping of output in mod_rewrite in Apache HTTP Server 2
osv·2024-07-01·CVSS 9.1
CVE-2024-38475 [CRITICAL] CVE-2024-38475: Improper escaping of output in mod_rewrite in Apache HTTP Server 2
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
VulnCheck
Apache HTTP Server Improper Escaping of Output Vulnerability
vulncheck·2024·CVSS 9.1
CVE-2024-38475 [CRITICAL] CWE-116 Apache HTTP Server Improper Escaping of Output Vulnerability
Apache HTTP Server Improper Escaping of Output Vulnerability
Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.
Affected: Apache HTTP Server
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://labs.watchtowr.com/sonicboom-from-
VulnCheck
SonicWall SMA100 Appliances OS Command Injection Vulnerability
vulncheck·2023·CVSS 7.2
CVE-2023-44221 [HIGH] CWE-78 SonicWall SMA100 Appliances OS Command Injection Vulnerability
SonicWall SMA100 Appliances OS Command Injection Vulnerability
SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.
Affected: SonicWall SMA100 Appliances
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://labs.watchtowr.com/sonicboom-from-stolen-tokens-to-remote-shells-sonicwall-sma100-cve-2023-4422
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2025-07-21·CVSS 9.8
CVE-2024-38474 [CRITICAL] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
USN-6885-1 fixed vulnerabilities in Apache. This update provides
the corresponding updates for Ubuntu 14.04 LTS.
Original advisory details:
Orange Tsai discovered that the Apache HTTP Server mod_rewrite module
incorrectly handled certain substitutions. A remote attacker could
possibly use this issue to execute scripts in directories not directly
reachable by any URL, or cause a denial of service. Some environments
may require using the new UnsafeAllow3F flag to handle unsafe
substitutions. (CVE-2024-38474, CVE-2024-38475)
Instructions: In general, a standard system update will make all the necessary changes.
CISA
Apache HTTP Server Improper Escaping of Output Vulnerability
cisa·2025-05-01·CVSS 9.1
CVE-2024-38475 [CRITICAL] CWE-116 Apache HTTP Server Improper Escaping of Output Vulnerability
Vulnerability: Apache HTTP Server Improper Escaping of Output Vulnerability
Affected: Apache HTTP Server
Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For
Palo Alto
PAN-SA-2025-0006 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2025-02-12·CVSS 7.1
CVE-2015-5312 [HIGH] PAN-SA-2025-0006 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2025-0006 Informational Bulletin: Impact of OSS CVEs in PAN-OS
T he Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2015-5312, CVE-2016-4607, CVE-2016-4608, CVE-2016-4609, CVE-2016-4738, CVE-2018-1111, CVE-2018-14634, CVE-2018-18653, CVE-2019-0145, CVE-2019-8331, CVE-2020-0599, CVE-2020-14343, CVE-2020-14779, CVE-2020-27844, CVE-2020-29569, CVE-2021-21315, CVE-2021-27853, CVE-2021-27854, CVE-2021-27861, CVE-2021-27862, CVE-2021-3618, CVE-2021-3711, CVE-2022-2097, CVE-2022-22816, CVE-2022-40303, CVE-2022-41723, CVE-2022-41741, CVE-2022-41742, CVE-2023-3247, CVE-2023-38408, CVE-2023-44466, CVE-2023-50781, CVE-2023-50782, CVE-2024-12084, CV
Oracle
Oracle Oracle Communications Risk Matrix: Platform (Apache HTTP Server) — CVE-2024-38475
vendor_oracle·2025-01-15·CVSS 8.2
CVE-2024-38475 [CRITICAL] Oracle Oracle Communications Risk Matrix: Platform (Apache HTTP Server) — CVE-2024-38475
Oracle Oracle Communications Risk Matrix: Platform (Apache HTTP Server) vulnerability
CVE: CVE-2024-38475
CVSS: 8.2
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2025 (JAN 2025)
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2024-09-18·CVSS 9.8
CVE-2024-38475 [CRITICAL] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
USN-6885-1 fixed several vulnerabilities in Apache. This update provides
the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
Orange Tsai discovered that the Apache HTTP Server mod_rewrite module
incorrectly handled certain substitutions. A remote attacker could
possibly use this issue to execute scripts in directories not directly
reachable by any URL, or cause a denial of service. Some environments
may require using the new UnsafeAllow3F flag to handle unsafe
substitutions. (CVE-2024-38474, CVE-2024-38475)
Orange Tsai discovered that the Apache HTTP Server incorrectly handled
certain response headers. A remote attacker could possibly
Ubuntu
Apache HTTP Server regression
vendor_ubuntu·2024-07-11·CVSS 5.4
[MEDIUM] Apache HTTP Server regression
Title: Apache HTTP Server regression
Summary: USN-6885-1 introduced a regression in Apache HTTP Server.
USN-6885-1 fixed vulnerabilities in Apache HTTP Server. One of the security
fixes introduced a regression when proxying requests to a HTTP/2 server.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Marc Stern discovered that the Apache HTTP Server incorrectly handled
serving WebSocket protocol upgrades over HTTP/2 connections. A remote
attacker could possibly use this issue to cause the server to crash,
resulting in a denial of service. (CVE-2024-36387)
Orange Tsai discovered that the Apache HTTP Server mod_proxy module
incorrectly sent certain request URLs with incorrect encodings to backends.
A remote attacker could possibly use this i
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2024-07-08·CVSS 5.4
CVE-2024-38475 [MEDIUM] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
Marc Stern discovered that the Apache HTTP Server incorrectly handled
serving WebSocket protocol upgrades over HTTP/2 connections. A remote
attacker could possibly use this issue to cause the server to crash,
resulting in a denial of service. (CVE-2024-36387)
Orange Tsai discovered that the Apache HTTP Server mod_proxy module
incorrectly sent certain request URLs with incorrect encodings to backends.
A remote attacker could possibly use this issue to bypass authentication.
(CVE-2024-38473)
Orange Tsai discovered that the Apache HTTP Server mod_rewrite module
incorrectly handled certain substitutions. A remote attacker could possibly
use this issue to execute scripts in directori
Red Hat
httpd: Improper escaping of output in mod_rewrite
vendor_redhat·2024-07-01·CVSS 9.1
CVE-2024-38475 [CRITICAL] CWE-116 httpd: Improper escaping of output in mod_rewrite
httpd: Improper escaping of output in mod_rewrite
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.
Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
A flaw was found in the mod_rewrite module of httpd. Improper escaping of output allows an attacker to map URLs to filesystem locations permitt
Debian
CVE-2024-38475: apache2 - Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earl...
vendor_debian·2024·CVSS 9.1
CVE-2024-38475 [CRITICAL] CVE-2024-38475: apache2 - Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earl...
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
Scope: local
bookworm: resolved (fixed in 2.4.61-1~deb12u1)
bullseye: resolved (fixed in 2.4.61-1~deb11u1)
forky: resolved (fixed in 2.4.60-1)
sid: resolved (fixed in 2.4.60-1)
trixie: resolved (
No detection rules found.
Nuclei
Sonicwall - Pre-Authentication Arbitrary File Read
nuclei·CVSS 9.1
CVE-2024-38475 [CRITICAL] Sonicwall - Pre-Authentication Arbitrary File Read
Sonicwall - Pre-Authentication Arbitrary File Read
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
Template:
id: CVE-2024-38475
info:
name: Sonicwall - Pre-Authentication Arbitrary File Read
author: shaikhyaser
severity: critical
descripti
Greynoiseio
Active Reconnaissance Campaign Targets SonicWall Firewalls Through Commercial Proxy Infrastructure
blogs_greynoiseio·2026-02-27
Active Reconnaissance Campaign Targets SonicWall Firewalls Through Commercial Proxy Infrastructure
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Bleepingcomputer
SonicWall urges admins to patch critical RCE flaw in SMA 100 devices
blogs_bleepingcomputer·2025-07-24·CVSS 6.5
CVE-2025-40599 [MEDIUM] SonicWall urges admins to patch critical RCE flaw in SMA 100 devices
## SonicWall urges admins to patch critical RCE flaw in SMA 100 devices
## Sergiu Gatlan
SonicWall urges customers to patch SMA 100 series appliances against a critical authenticated arbitrary file upload vulnerability that can let attackers gain remote code execution.
The security flaw (tracked as CVE-2025-40599) is caused by an unrestricted file upload weakness in the devices' web management interfaces, which can allow remote threat actors with administrative privileges to upload arbitrary files to the system.
"SonicWall strongly recommends that users of the SMA 100 series products (SMA 210, 410, and 500v) upgrade to the specified fixed release version to remediate this vulnerability," the company said . "This vulnerability does not affect SonicWall SSL VPN SMA1000 series products or
Bleepingcomputer
SonicWall SMA devices hacked with OVERSTEP rootkit tied to ransomware
blogs_bleepingcomputer·2025-07-16·CVSS 6.5
[MEDIUM] SonicWall SMA devices hacked with OVERSTEP rootkit tied to ransomware
## SonicWall SMA devices hacked with OVERSTEP rootkit tied to ransomware
## Ionut Ilascu
A threat actor has been deploying a previously unseen malware called OVERSTEP that modifies the boot process of fully-patched but no longer supported SonicWall Secure Mobile Access appliances.
The backdoor is a user-mode rootkit that allows hackers to hide malicious components, maintain persistent access on the device, and steal sensitive credentials.
Researchers at Google Threat Intelligence Group (GTIG) observed the rootkit in attacks that may have relied on “an unknown, zero-day remote code execution vulnerability”.
The threat actor is tracked as UNC6148 and has been operating since at least last October, with an organization being targeted as recently as May.
Because files stolen from the vic
Wiz
Crying Out Cloud Newsletter - June 2025 | Wiz
blogs_wiz·2025-06-01·CVSS 9.8
[CRITICAL] Crying Out Cloud Newsletter - June 2025 | Wiz
Welcome back!
This month we’ve seen a lot of action, with both vulnerabilities and security incidents that have left users affected. We bring you the latest cloud security highlights, to help you stay informed and stay secure. Here are our top picks of cloud security highlights!
## 🔍 Highlights
## Ivanti EPMM RCE Vulnerability Chain Exploited in the Wild
On May 13th, 2025, Ivanti disclosed that Endpoint Manager Mobile (EPMM) is affected by a vulnerability chain combining an authentication bypass (CVE-2025-4427) and a post-authentication remote code execution vulnerability (CVE-2025-4428). These flaws, which stem from unsafe use of Java Expression Language in error messages and misconfigured routing, can be exploited together to achieve unauthenticated RCE. Therefore, while neither of t
Bleepingcomputer
SonicWall urges admins to patch VPN flaw exploited in attacks
blogs_bleepingcomputer·2025-05-08·CVSS 8.8
CVE-2025-32819 [HIGH] SonicWall urges admins to patch VPN flaw exploited in attacks
## SonicWall urges admins to patch VPN flaw exploited in attacks
## Sergiu Gatlan
SonicWall has urged its customers to patch three security vulnerabilities affecting its Secure Mobile Access (SMA) appliances, one of them tagged as exploited in attacks.
Discovered and reported by Rapid7 cybersecurity researcher Ryan Emmons, the three security flaws (CVE-2025-32819, CVE-2025-32820, and CVE-2025-32821) can be chained by attackers to gain remote code execution as root and compromise vulnerable instances.
The vulnerabilities impact SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v devices and are patched in firmware version 10.2.1.15-81sv and higher.
"SonicWall strongly advises users of the SMA 100 series products (SMA 200, 210, 400, 410, and 500v) to upgrade to the mentioned fixed release
Checkpoint
5th May – Threat Intelligence Report
blogs_checkpoint·2025-05-05
CVE-2023-44221 5th May – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 5th May – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 5th May, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Three major UK retailers – Co-op , Harrods and Marks & Spencer (M&S) – were hit by cyberattacks that disrupted operations and compromised sensitive data. The attacks are believed linked to the Scattered Spider gang, while DragonForce ransomware gang claimed responsibility for the attacks.
The American non-profit healthcare system,
Bleepingcomputer
SonicWall warns of more VPN flaws exploited in attacks
blogs_bleepingcomputer·2025-04-30·CVSS 6.5
CVE-2023-44221 [MEDIUM] SonicWall warns of more VPN flaws exploited in attacks
## SonicWall warns of more VPN flaws exploited in attacks
## Sergiu Gatlan
Cybersecurity company SonicWall has warned customers that two older vulnerabilities impacting its Secure Mobile Access (SMA) appliances are now being actively exploited in attacks.
On Tuesday, SonicWall updated security advisories for the CVE-2023-44221 and CVE-2024-38475 security flaws to tag the two vulnerabilities as "potentially being exploited in the wild."
CVE-2023-44221 is described as a high-severity command injection vulnerability caused by improper neutralization of special elements in the SMA100 SSL-VPN management interface that enables attackers with admin privileges to inject arbitrary commands as a 'nobody' user.
The second security bug, CVE-2024-38475, is rated as a critical severity flaw caused
Qualys
Oracle Critical Patch Update, January 2025 Security Update Review
blogs_qualys·2025-01-23
Oracle Critical Patch Update, January 2025 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
Oracle released its first quarterly edition of this year’s Critical Patch Update, which received patches for 318 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 85 constituting about 27% of the total patches released. Oracle MySQL and Oracle Financial Services Applications followed,
Qualys
Oracle Critical Patch Update, January 2025 Security Update Review | Qualys
blogs_qualys·2025-01-23
Oracle Critical Patch Update, January 2025 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
Oracle released its first quarterly edition of this year’s Critical Patch Update, which received patches for 318 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 85 constituting about 27% of the total patches released. Oracle MySQL and Oracle Financial Services Applications fol
Greynoiseio
NoiseLetter May 2025
blogs_greynoiseio
NoiseLetter May 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
CTF
Web / ApacheCultureNight
ctf_writeups·2025·CVSS 9.1
CVE-2024-38475 [CRITICAL] Web / ApacheCultureNight
This challenges revolves around the bugs in this blog post: https://blog.orange.tw/posts/2024-08-confusion-attacks-en/
The Apache and oranges hint towards it.
Solution:
```
curl http://172.17.0.2/flag.txt%3flol.png
```
CVE-2024-38475
This is a truncation bug where the .png is used to trigger the rewrite rule but when the file path is accessed everything after the `?` is removed, thus accessing a file it shouldn't
HackerOne
important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)
hackerone·2024-07-13·CVSS 9.1
CVE-2024-38475 [CRITICAL] important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)
important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)
I reported this vulnerability through the official Apache HTTP Server security email on April 1, 2024, and received a fix along with a CVE number on July 1, 2024. You can check detailed information from there:
> https://httpd.apache.org/security/vulnerabilities_24.html
## Impact
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.
Substitutions in server context that use a backreferences or variables as the first segm
https://httpd.apache.org/security/vulnerabilities_24.htmlhttps://security.netapp.com/advisory/ntap-20240712-0001/http://www.openwall.com/lists/oss-security/2024/07/01/8https://github.com/apache/httpd/commit/9a6157d1e2f7ab15963020381054b48782bc18cfhttps://httpd.apache.org/security/vulnerabilities_24.htmlhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018https://security.netapp.com/advisory/ntap-20240712-0001/https://www.blackhat.com/us-24/briefings/schedule/index.html#confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-pre-recorded-40227https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38475
2024-07-01
Published
2025-05-01
Added to CISA KEV
Exploited in the wild