Internet Bug Bounty · Report #2612028

important: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (CVE-2024-40898)

Validstatus

highseverity

$4,263bounty

19upvotes

27 Aug 2024disclosed

Summary

important: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (CVE-2024-40898) SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests.

Users are recommended to upgrade to version 2.4.62 which fixes this issue.

Acknowledgements:

finder: Smi1e (DBAPPSecurity Ltd.) finder: xiaojunjie (DBAPPSecurity Ltd.)

Security Advisory: https://httpd.apache.org/security/vulnerabilities_24.html

How it was found

I reported this vulnerability through the official Apache HTTP Server security email on 2024-07-12, and received a CVE number on 2024-07-17. You can check detailed information from here: https://httpd.apache.org/security/vulnerabilities_24.html

Impact

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original