Internet Bug Bounty · Report #2585385
important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)
Summary
important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)
SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content
Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
Acknowledgements: finder: Orange Tsai (@orange_8361) from DEVCORE
Reported to security team: 2024-04-01 fixed by r1918558 in 2.4.x: 2024-07-01 Update 2.4.60 released: 2024-07-01 Affects: 2.4.0 through 2.4.59
How it was found
I reported this vulnerability through the official Apache HTTP Server security email on April 1, 2024, and received a fix along with a CVE number on July 1, 2024. You can check detailed information from there:
Impact
SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content
Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.