EUVD-2024-54772CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4Description
Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via mod_rewrite or apache expressions that pass unvalidated request input. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.63. Note: The Apache HTTP Server Project will be setting a higher bar for accepting vulnerability reports regarding SSRF via UNC paths. The server offers limited protection against administrators directing the server to open UNC paths. Windows servers should limit the hosts they will connect over via SMB based on the nature of NTLM authentication.
Analysis
CVE-2024-43394 is a Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows (versions 2.4.0-2.4.63) that allows unauthenticated remote attackers to leak NTLM credential hashes to malicious servers through unvalidated request input processed by mod_rewrite or Apache expressions. The vulnerability exploits Windows SMB/UNC path handling to trigger NTLM authentication, potentially compromising domain credentials. This is a high-severity issue affecting all default Windows installations without explicit UNC path filtering.
Technical Context
The vulnerability stems from CWE-918 (Server-Side Request Forgery) where Apache HTTP Server's mod_rewrite module and expression evaluation engine fail to sanitize user-controlled input before constructing resource requests. On Windows systems, Apache can be directed to access UNC paths (\\server\share format) via manipulated rewrite rules or expressions. When Apache attempts to access these attacker-controlled UNC paths, the Windows SMB protocol automatically initiates NTLM authentication, sending the server's cached credentials (NTLM hashes) to the attacker's server. The affected CPE is cpe:2.7.a:apache:http_server:*:*:*:*:*:*:*:* with version range 2.4.0 through 2.4.63. The root cause is insufficient input validation in mod_rewrite directive processing and Apache expression evaluation functions that construct file/resource paths without proper canonicalization or UNC path detection.
Affected Products
Apache HTTP Server (2.4.0 through 2.4.63)
Remediation
Upgrade to Apache HTTP Server 2.4.64 or later (assumed to contain the fix; exact patch version should be verified from Apache advisory); priority: Critical Mitigation: For Windows servers unable to patch immediately: Restrict SMB-based host connections by implementing Windows firewall rules or Group Policy to block outbound SMB (ports 139, 445) to untrusted hosts; priority: High Mitigation: Audit all mod_rewrite rules and Apache expressions to identify instances where user-controlled input (query parameters, headers, request URIs) are directly incorporated into file paths or resource identifiers; priority: High Mitigation: Implement input validation to reject or sanitize UNC paths (\\server\share patterns) and file:// URIs in rewrite rules; priority: High Workaround: Disable mod_rewrite or restrict its use to non-user-controlled path components; priority: Medium Reference: Monitor Apache Security Advisory pages (httpd.apache.org/security) for official patch release and detailed remediation guidance
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| upstream | not-affected | debian: Windows specific |
| bionic | not-affected | Windows-specific |
| focal | not-affected | Windows-specific |
| jammy | not-affected | Windows-specific |
| noble | not-affected | Windows-specific |
| plucky | not-affected | Windows-specific |
| trusty | not-affected | Windows-specific |
| xenial | not-affected | Windows-specific |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 2.4.65-1~deb11u1 | - |
| bullseye (security) | fixed | 2.4.66-1~deb11u1 | - |
| bookworm | fixed | 2.4.66-1~deb12u1 | - |
| bookworm (security) | fixed | 2.4.62-1~deb12u2 | - |
| trixie | fixed | 2.4.66-1~deb13u2 | - |
| forky, sid | fixed | 2.4.66-8 | - |
| (unstable) | not-affected | - | - |
Share
External POC / Exploit Code
Leaving vuln.today