CVE-2024-38472
published 2024-07-01CVE-2024-38472: SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are…
PriorityP273high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
67.95%
99.2th percentile
SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content
Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.4.0 < 2.4.60 | 2.4.60 |
| apache_software_foundation | apache_http_server | 2.4.0 – 2.4.59 | — |
| debian | apache2 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| netapp | ontap | — | — |
| paloalto | pan-os | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit sends a GET request with a URL-encoded UNC path (\\<attacker-host>\apachehttpd) to trigger SSRF; detect by monitoring for outbound SMB/NetBIOS connections from the Apache server process to external hosts, which may carry NTLM hashes. ↗
- →Look for HTTP requests containing the URL-encoded UNC path pattern `%5C%5C` (double backslash) in the request URI targeting Apache on Windows, which is the encoded form used to trigger the UNC SSRF. ↗
- →Monitor interactsh/OOB DNS callbacks for the label `apachehttpd` as a canary for successful SSRF exploitation attempts against CVE-2024-38472. ↗
- →Affected versions are Apache HTTP Server 2.4.0 through 2.4.59 on Windows; flag any such version running on Windows as vulnerable. ↗
- ·After upgrading to 2.4.60, existing configurations that access UNC paths must explicitly allowlist them via the new `UNCList` directive, otherwise UNC path access during request processing will be blocked. ↗
- ·This vulnerability is Windows-specific; Apache httpd packages shipped with Red Hat Enterprise Linux 6, 7, 8, and 9 are not affected because they run on Linux. ↗
- ·Red Hat JBoss Core Services (jbcs-httpd24-httpd) is listed as Affected, meaning Windows-deployed JBoss Core Services instances should be prioritised for patching. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_debian7.5LOW
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2025-0006 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2025-02-12·CVSS 7.1
CVE-2015-5312 [HIGH] PAN-SA-2025-0006 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2025-0006 Informational Bulletin: Impact of OSS CVEs in PAN-OS
T he Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2015-5312, CVE-2016-4607, CVE-2016-4608, CVE-2016-4609, CVE-2016-4738, CVE-2018-1111, CVE-2018-14634, CVE-2018-18653, CVE-2019-0145, CVE-2019-8331, CVE-2020-0599, CVE-2020-14343, CVE-2020-14779, CVE-2020-27844, CVE-2020-29569, CVE-2021-21315, CVE-2021-27853, CVE-2021-27854, CVE-2021-27861, CVE-2021-27862, CVE-2021-3618, CVE-2021-3711, CVE-2022-2097, CVE-2022-22816, CVE-2022-40303, CVE-2022-41723, CVE-2022-41741, CVE-2022-41742, CVE-2023-3247, CVE-2023-38408, CVE-2023-44466, CVE-2023-50781, CVE-2023-50782, CVE-2024-12084, CV
Microsoft
CVE-2024-38472: NIST NVD Details: https://nvd
vendor_msrc·2024-12-10·CVSS 7.5
CVE-2024-38472 [HIGH] CVE-2024-38472: NIST NVD Details: https://nvd
NIST NVD Details: https://nvd.nist.gov/vuln/detail/CVE-2024-38472
Mariner: Mariner
[email protected]: [email protected]
Customer Action Required: Yes
Exploit Status: DOS:N/A
Remediation: httpd
Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-38472
Red Hat
httpd: SSRF in Apache HTTP Server on Windows
vendor_redhat·2024-07-01·CVSS 7.5
CVE-2024-38472 [HIGH] CWE-918 httpd: SSRF in Apache HTTP Server on Windows
httpd: SSRF in Apache HTTP Server on Windows
SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content
Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
A flaw was found in httpd on Windows systems. This issue potentially allows NTLM hashes to be leaked to a malicious server via Server-side request forgery (SSRF) and malicious requests or content.
Statement: This flaw only affects httpd running on Windows systems. Therefore, the httpd package as shipped in Red Hat Enterprise Linux 6, 7, 8 and 9 is not affected by this vulnerability.
Packag
Debian
CVE-2024-38472: apache2 - SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to ...
vendor_debian·2024·CVSS 7.5
CVE-2024-38472 [HIGH] CVE-2024-38472: apache2 - SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to ...
SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-fjcc-r94c-wxr8: SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content
Users ar
ghsa_unreviewed·2024-07-01
CVE-2024-38472 [HIGH] CWE-918 GHSA-fjcc-r94c-wxr8: SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content
Users ar
SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content
Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
OSV
CVE-2024-38472: SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content
Users ar
osv·2024-07-01·CVSS 7.5
CVE-2024-38472 [HIGH] CVE-2024-38472: SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content
Users ar
SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content
Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
No detection rules found.
Nuclei
Apache HTTPd Windows UNC - Server-Side Request Forgery
nuclei·CVSS 7.5
CVE-2024-38472 [HIGH] Apache HTTPd Windows UNC - Server-Side Request Forgery
Apache HTTPd Windows UNC - Server-Side Request Forgery
SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note- Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
Template:
id: CVE-2024-38472
info:
name: Apache HTTPd Windows UNC - Server-Side Request Forgery
author: pdteam
severity: high
description: |
SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note- Existing configura
2024-07-01
Published