{"id":"CVE-2023-25690","published":"2023-03-07T15:09:03Z","modified":"2025-12-18T15:37:41Z","title":"Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy","vendor":"Apache Software Foundation","product":"Apache HTTP Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache HTTP Server","versions":[">= 2.4.0, <= 2.4.55"]}],"description":{"text":"Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.\n\n\n\n\nConfigurations are affected when mod_proxy is enabled along with some form of RewriteRule\n or ProxyPassMatch in which a non-specific pattern matches\n some portion of the user-supplied request-target (URL) data and is then\n re-inserted into the proxied request-target using variable \nsubstitution. For example, something like:\n\n\n\n\nRewriteEngine on\nRewriteRule \"^/here/(.*)\" \"http://example.com:8080/elsewhere?$1\"; [P]\nProxyPassReverse /here/ http://example.com:8080/\n\n\nRequest splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Apache HTTP Server (Apache Software Foundation) contains an HTTP request smuggling flaw in some mod_proxy configurations, where a non-specific RewriteRule or ProxyPassMatch pattern lets user-supplied request-target data be re-inserted into the proxied request via variable substitution. An attacker able to send crafted HTTP requests can exploit this, with no authentication or user interaction required, when mod_proxy is enabled alongside such a rule, to split or smuggle requests and thereby bypass proxy access controls, reach unintended URLs on origin servers, or poison caches.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:22Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.84508,"percentile":0.997,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-07-25","exploitedFirstSeen":"2024-07-25","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/2024-07/aa24-207a-dprk-cyber-group-conducts-global-espionage-campaign.pdf","date":"2024-07-25"},{"url":"https://media.defense.gov/2024/Sep/18/2003547016/-1/-1/0/CSA-PRC-LINKED-ACTORS-BOTNET.PDF","date":"2024-09-18"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":16,"pulses":[{"name":"Update 10: Cybercriminals Leverage 66 Vulnerabilities to Target Global Systems","url":"https://otx.alienvault.com/pulse/68651d685fb2301208e89b10","created":"2025-07-02"},{"name":"Veriti Research Uncovers Malware Exploiting Cloud Services  - VERITI","url":"https://otx.alienvault.com/pulse/67d031cf1fa149f30e59fe81","created":"2025-03-11"},{"name":"NCSC Advisory - 18th Sept 2024 - PRC Botnet","url":"https://otx.alienvault.com/pulse/678638141cbf938dbca1090d","created":"2025-01-14"},{"name":"People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations","url":"https://otx.alienvault.com/pulse/677cd56c6fd3f2632e1b4411","created":"2025-01-07"},{"name":"People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations","url":"https://otx.alienvault.com/pulse/677cd54761ae1299ecfe27aa","created":"2025-01-07"},{"name":"People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations","url":"https://otx.alienvault.com/pulse/66fd391fe0318d98f8af0eb4","created":"2024-10-02"},{"name":"CSA-PRC-LINKED-ACTORS-BOTNET","url":"https://otx.alienvault.com/pulse/66ebe08841abbc50444fbcae","created":"2024-09-19"},{"name":"NCSC and partners issue warning over North Korean state-sponsored cyber campaign to steal military and nuclear secrets","url":"https://otx.alienvault.com/pulse/66b1ebf1bb045b0a9ac380d8","created":"2024-08-06"},{"name":"Exposing Onyx Sleet: Indictments, TTPs, and Arsenal","url":"https://otx.alienvault.com/pulse/66aa334b7fc91f0b45a50743","created":"2024-07-31"},{"name":"ACTUALIZACION | Security update available for Adobe Experience Manager | Adobe","url":"https://otx.alienvault.com/pulse/6616c4fa54bdea6d1821746a","created":"2024-04-10"}],"provenance":"machine"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["vendor-advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html","tags":[]},{"url":"https://security.gentoo.org/glsa/202309-01","tags":[]},{"url":"http://packetstormsecurity.com/files/176334/Apache-2.4.55-mod_proxy-HTTP-Request-Smuggling.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-29605","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-29605","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":0,"earliest":"2023-04-25","earliestUrl":"https://github.com/tbachvarova/linux-apache-fix-mod_rewrite-spaceInURL","repos":[{"name":"dhmosfunk/CVE-2023-25690-POC","url":"https://github.com/dhmosfunk/CVE-2023-25690-POC","stars":288,"created":"2023-05-22"},{"name":"thanhlam-attt/CVE-2023-25690","url":"https://github.com/thanhlam-attt/CVE-2023-25690","stars":4,"created":"2023-12-04"},{"name":"oOCyginXOo/CVE-2023-25690-POC","url":"https://github.com/oOCyginXOo/CVE-2023-25690-POC","stars":2,"created":"2025-06-01"},{"name":"tbachvarova/linux-apache-fix-mod_rewrite-spaceInURL","url":"https://github.com/tbachvarova/linux-apache-fix-mod_rewrite-spaceInURL","stars":1,"created":"2023-04-25"},{"name":"arnavps/CTF-Web-Exploitation","url":"https://github.com/arnavps/CTF-Web-Exploitation","stars":1,"created":"2026-04-05"}]},"first":{"date":"2023-04-25","source":"PoC-in-GitHub","url":"https://github.com/tbachvarova/linux-apache-fix-mod_rewrite-spaceInURL"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/176334/Apache-2.4.55-mod_proxy-HTTP-Request-Smuggling.html"],"flow":[],"timeline":[{"date":"2023-03-07","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-25690","provenance":"source"},{"date":"2023-04-25","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/tbachvarova/linux-apache-fix-mod_rewrite-spaceInURL","provenance":"source"},{"date":"2024-07-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/2024-07/aa24-207a-dprk-cyber-group-conducts-global-espionage-campaign.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":49,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":69.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 827 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9970"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 7 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.79,"detail":"16 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}