Server-Side Request Forgery in Apache HTTP Server on Windows

CVE-2024-43394

What is CVE-2024-43394?

A vulnerability in Apache HTTP Server for Windows allows for potential Server-Side Request Forgery. This can lead to the exposure of NTLM hashes to an attacker-controlled server. The flaw arises through the use of mod_rewrite or other Apache expressions that fail to properly validate request input. Systems running affected versions of Apache HTTP Server should implement limited connectivity settings for SMB to mitigate risks associated with NTLM authentication. As the Apache HTTP Server Project raises standards for reporting SSRF vulnerabilities, users are advised to secure their configurations against this targeted threat.

References