Critical SSRF Vulnerability in Apache HTTP Server: CVE-2024-43394
Summary
UBUNTU-CVE-2024-43394: Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via mod_rewrite or apache expressions that pass unvalidated request input. Affects apache2 versions 2.4.6-2ubuntu2 – 2.4.7-1ubuntu4.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software that enables users to serve web content over the internet. It is known for its flexibility, security features, and extensive module support. However, it has been identified that certain versions of Apache HTTP Server are vulnerable to a Server-Side Request Forgery (SSRF) attack, which can lead to unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability, identified as CVE-2024-43394, allows attackers to exploit the Apache HTTP Server on Windows systems to potentially leak NTLM hashes to a malicious server. This is achieved through the use of mod_rewrite or Apache expressions that process unvalidated request input. The issue affects versions from 2.4.0 to 2.4.63, posing a significant risk as it can lead to unauthorized access and data exposure. The Apache HTTP Server Project has indicated that they will be more stringent in accepting vulnerability reports related to SSRF via UNC paths, highlighting the need for administrators to limit connections over SMB based on NTLM authentication.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, Windows server administrators should limit the hosts that the server can connect to over SMB. This can be done by configuring firewall rules or modifying server settings to restrict access to trusted hosts only.
Conclusion
The CVE-2024-43394 vulnerability poses a serious risk to Apache HTTP Server installations on Windows, allowing for potential data leakage through SSRF attacks. It is imperative for users to update their servers to the latest patched versions and implement recommended workarounds to mitigate risks.
See every vulnerability recorded for apache2 →
FAQ
CVE-2024-43394 is a vulnerability in Apache HTTP Server that allows for Server-Side Request Forgery (SSRF) attacks, potentially leading to the leakage of NTLM hashes.
The vulnerability affects Apache HTTP Server versions from 2.4.0 to 2.4.63.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
NTLM hashes are used in Windows authentication protocols. If leaked, they can allow attackers to gain unauthorized access to systems.
If immediate updates are not possible, implement the recommended workarounds by restricting server connections to trusted hosts only.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
