Vulnerability record · CVE-2024-38472 · published 1 July 2024
CVE-2024-38472: Apache HTTP Server on Windows SSRF leaks NTLM hashes
Apache · Http Server
Apache HTTP Server on Windows is vulnerable to server-side request forgery that can cause the server to send NTLM authentication to an attacker-controlled host, leaking NTLM hashes. The flaw is fixed in version 2.4.60, and existing configurations that access UNC paths must configure the new UNCList directive to allow access during request processing.
Description
SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityCVSS 7.5 with no authentication or user interaction required and a very high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is provided.
What it is
Apache HTTP Server on Windows is vulnerable to server-side request forgery that can cause the server to send NTLM authentication to an attacker-controlled host, leaking NTLM hashes. The flaw is fixed in version 2.4.60, and existing configurations that access UNC paths must configure the new UNCList directive to allow access during request processing.
Impact
An attacker can force the server to authenticate to a malicious server and capture NTLM hashes, which can then be cracked or relayed to gain access to other systems.
Attack surface
Reachable over the network via crafted requests or content that trigger SSRF; the CVSS vector indicates no authentication or user interaction is required.
Exploitation
Not listed in CISA KEV and no public exploit references are provided, but EPSS is 0.6947 (99.3rd percentile), indicating a high predicted likelihood of exploitation activity.
What to do
- Upgrade Apache HTTP Server to version 2.4.60 or later.
- On existing configurations that access UNC paths, configure the new UNCList directive to explicitly allow required access during request processing.
- Restrict outbound network access from the web server to only necessary destinations to limit SSRF reach.
- Disable or restrict Windows integrated authentication/NTLM where it is not required for the application.
- Monitor and block outbound SMB/UNC connections from web server hosts to untrusted networks.
Detection
- Monitor web server logs for requests or content that cause outbound connections to unexpected or attacker-controlled hosts.
- Alert on outbound SMB/UNC or NTLM authentication attempts originating from the Apache HTTP Server process.
- Review Windows event logs for NTLM authentication attempts from the web server to external or unusual hosts.
- Track Apache HTTP Server versions in the environment and flag hosts below 2.4.60.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://httpd.apache.org/security/vulnerabilities_24.html | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2024/07/01/5 | Mailing List |
| https://httpd.apache.org/security/vulnerabilities_24.html | Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20240712-0001/ | Third Party Advisory |
Track CVE-2024-38472 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-38472), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
