Server-Side Request Forgery (SSRF) Vulnerability in Apache HTTP Server - CVE-2024-43394
Summary
CVE-2024-43394: Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via mod_rewrite or apache expressions that pass unvalidated request input. Affects apache2 across 2 version ranges.
< 2.4.64-r0
>= da5873e80d6eee7a0838793bf68f1d0254745fbb, < 7e926454793abd7d71b6afc8bd1ec1648752c6ad
Fixed in 2.4.64-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software that enables the hosting of websites and web applications. It is known for its flexibility, robustness, and support for various modules that enhance its functionality. However, certain versions of Apache HTTP Server are vulnerable to a Server-Side Request Forgery (SSRF) issue, which can lead to potential security risks, particularly on Windows systems.
Vulnerability Detail
The vulnerability identified as CVE-2024-43394 allows for Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows. This issue can potentially leak NTLM hashes to a malicious server through mod_rewrite or Apache expressions that process unvalidated request input. The vulnerability affects versions from 2.4.0 to 2.4.63, posing a significant risk as it may enable attackers to exploit the server's connection capabilities to unauthorized hosts.
How To Fix
Minimum fixed version
2.4.64-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, Windows server administrators should limit the hosts that the server can connect to over SMB, based on the nature of NTLM authentication. This can help mitigate the risk of unauthorized access while a permanent fix is being implemented.
Conclusion
The CVE-2024-43394 vulnerability in Apache HTTP Server poses a significant risk to Windows systems, allowing for potential NTLM hash leaks through SSRF. It is crucial for users to update to the patched version to mitigate these risks and implement recommended workarounds until the update can be applied.
See every vulnerability recorded for apache2 →
FAQ
CVE-2024-43394 is a vulnerability in Apache HTTP Server that allows for Server-Side Request Forgery (SSRF) on Windows systems, potentially leading to NTLM hash leaks.
The vulnerability affects Apache HTTP Server versions from 2.4.0 to 2.4.63.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update your Apache HTTP Server to version 2.4.64-r0 or later to secure your server against this vulnerability.
SSRF is a type of security vulnerability that allows an attacker to send crafted requests from the server to internal or external resources, potentially leading to unauthorized access or data leakage.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
