Apache HTTP Server mod_rewrite/mod_setenvif/mod_proxy_fcgi ap_expr Local File Read — CVE-2026-24072

Metadata

Affected Target

Summary

Apache HTTP Server’s ap_expr expression evaluation engine exposes filesystem-introspection functions (file(), filesize(), and tests like -f, -d, -e, -s, -L, -h, -x) that are meant to be restricted when expressions are parsed from a .htaccess file rather than the main server configuration. In versions up to and including 2.4.66, the modules mod_rewrite (RewriteCond expr=...), mod_setenvif (SetEnvIfExpr), and mod_proxy_fcgi (backend-type condition expressions) failed to pass the AP_EXPR_FLAG_RESTRICTED flag when parsing expressions in .htaccess (per-directory) context. This lets any local user who can place a .htaccess file in a directory served by Apache read or probe arbitrary files with the privileges of the httpd worker process, even though .htaccess authors are normally sandboxed away from filesystem access outside their directory. The repository is a technical writeup with the three module patch diffs, vulnerable/fixed Apache source trees, and a Dockerized test lab with a sentinel file to demonstrate the vulnerable vs. patched behavior.

Vulnerability Details

Root Cause

mod_rewrite, mod_setenvif, and mod_proxy_fcgi parse ap_expr expressions without setting AP_EXPR_FLAG_RESTRICTED when the parsing context is .htaccess (detected via the internal convention cmd->pool == cmd->temp_pool), allowing filesystem-reading expression functions to run unrestricted in a context meant to be sandboxed.

Attack Vector

1. Obtain the ability to write a .htaccess file in any directory served by a vulnerable Apache HTTP Server (e.g., via shared hosting, an upload directory, or a compromised low-privilege web account).
2. Place directives such as RewriteCond expr "%{expr:file('/etc/shadow')}" or RewriteCond expr "-f /etc/shadow" in the .htaccess file.
3. Request any URL under that directory, causing Apache to evaluate the expression with httpd-user privileges.
4. Observe the result via a triggered rewrite/redirect, response header, or (in verbose/debug configurations) the error log, to infer file existence, size, or full contents.
5. Repeat with different paths/functions to enumerate or exfiltrate sensitive files readable by the httpd user.

Impact

A local user restricted to .htaccess-level configuration can read or probe arbitrary files accessible to the Apache worker process, bypassing the intended per-directory sandbox and potentially exposing credentials, other tenants’ files, or system configuration on shared/multi-tenant hosting.

Environment / Lab Setup

Target:   Apache HTTP Server <= 2.4.66 (vulnerable) vs. 2.4.67 (patched)
Attacker: Local .htaccess write access; Docker + make for the included test lab

Proof of Concept

PoC Script

See mod_rewrite.diff, mod_setenvif.diff, mod_proxy_fcgi.diff, examples/exploit.htaccess, examples/safe-expressions.htaccess, and CVE-2026-24072-analysis.md in this folder.

1
2
3

make build
make up
make test

examples/exploit.htaccess demonstrates the vulnerable behavior directly: RewriteCond expr directives using -f/-d/-e file-existence tests and file()/filesize() content/size probes against sensitive paths like /etc/passwd, /etc/shadow, and application config files. The three .diff files show the upstream fix (adding the AP_EXPR_FLAG_RESTRICTED flag in .htaccess context), and the Docker-based lab lets a reviewer flip between the vulnerable and patched module builds to confirm the sentinel file (/opt/sentinel/secret.txt) is readable only in the vulnerable configuration.

Detection & Indicators of Compromise

"...ap_expr: ... not available in restricted context..."
grep -R "expr:file(" /var/www -l --include=".htaccess"

Signs of compromise:

• .htaccess files in tenant/upload directories containing RewriteCond expr, SetEnvIfExpr, or proxy backend-type expressions referencing file(), filesize(), or filesystem test operators against paths outside the web root.
• Apache access/error logs showing repeated requests to a directory immediately after an unfamiliar .htaccess file is created or modified there.
• Unexplained knowledge of file existence/size/contents outside a tenant’s directory surfacing in rewrite redirects or response behavior.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/EricRHancock-coder/CVE-2026-24072-Analysis on 2026-07-05. Only the patch diffs, example .htaccess PoC files, and the technical analysis document were mirrored; the full vulnerable/patched Apache/APR source trees and Docker test-lab scaffolding from the original repository were omitted as they are the upstream project’s own build trees rather than PoC code.