Server-Side Request Forgery (SSRF) Vulnerability in Apache HTTP Server on Windows
Summary
ALPINE-CVE-2025-59775: Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious req... Affects apache2 versions < 2.4.66-r0. Fixed in 2.4.66-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software that enables users to serve web content. It is known for its flexibility, security features, and extensive support for various protocols. However, certain configurations can expose it to vulnerabilities, such as the SSRF vulnerability identified in this report, which can lead to sensitive information leakage.
Vulnerability Detail
The vulnerability arises from the configuration settings of the Apache HTTP Server, specifically when 'AllowEncodedSlashes' is set to 'On' and 'MergeSlashes' is set to 'Off'. This configuration allows an attacker to craft malicious requests that can exploit the server's ability to process encoded slashes, potentially leaking NTLM hashes to a malicious server. The ramifications of this vulnerability include unauthorized access to sensitive information and potential exploitation of the server.
How To Fix
Minimum fixed version
2.4.66-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the 'AllowEncodedSlashes' directive or set 'MergeSlashes' to 'On' in the Apache configuration file. This can be done by adding the following lines to your Apache configuration: 'AllowEncodedSlashes Off' and 'MergeSlashes On'. However, this is not a permanent fix and upgrading is recommended.
Conclusion
The SSRF vulnerability in Apache HTTP Server poses a significant risk to users who have misconfigured their server settings. It is crucial to upgrade to the patched version 2.4.66 or later to mitigate this risk. Additionally, implementing the recommended workarounds can provide temporary relief until the upgrade is completed.
See every vulnerability recorded for apache2 →
FAQ
SSRF is a type of security vulnerability that allows an attacker to send crafted requests from the server to internal or external resources, potentially leading to unauthorized access to sensitive data.
If exploited, this vulnerability can lead to the leakage of sensitive information, such as NTLM hashes, which can be used for further attacks against the server or network.
Avoid setting 'AllowEncodedSlashes' to 'On' and 'MergeSlashes' to 'Off' in your Apache configuration, as these settings can expose your server to SSRF attacks.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
