CVE-2024-38472 Scanner

Apache HTTP Server is a widely used web server software across various platforms, including Windows. It is utilized by developers and organizations to host websites, provide access to web applications, and serve content over the internet. This flexibility and reliability make it favorable for both small businesses and large enterprises, offering support for modules, extensive configurations, and security features. Due to its open-source nature, Apache is frequently updated by a community of developers, ensuring it stays robust against vulnerabilities. The software is compatible with various operating systems, supporting integrations with multiple technologies. Organizations rely on Apache HTTP Server for its performance optimization capabilities that cater to a high number of client requests.

The vulnerability discussed here is a Server-Side Request Forgery (SSRF) found in Apache HTTP Server on Windows. It allows attackers to craft requests or content that can induce the server to execute unintended interactions with other systems. In this specific SSRF instance, the vulnerability can potentially expose NTLM hashes to a malicious server upon interaction. Users interacting with UNC paths could unintentionally suffer data or credential exposure. The exposure stems from the server's failure to properly validate input, thus enabling requests to unintended URLs. This vulnerability is notable for the information disclosure it can facilitate.

The exploitation of this vulnerability in Apache HTTP Server involves performing a GET request designed to interact with an external server. The issue lies in the server's ability to process UNC paths without proper validation, redirecting services to potentially harmful resources. Attackers can use this mechanism to make the server initiate connections to a malicious server, enabling leakage of sensitive information like NTLM hashes. The server is tricked into believing it is accessing valid resources, allowing the intercept of application traffic.

Exploitation of this SSRF vulnerability can have significant impacts, including unauthorized access to sensitive data. If attackers capture NTLM hashes, they might be able to use these for subsequent attacks, potentially compromising user credentials or leading to further network intrusions. The vulnerability can also lead to disruptions in application functionality when the server processes maliciously crafted requests. The server-side component’s trust can be exploited, leading to unauthorized actions being carried out.

REFERENCES

• https://blog.orange.tw/2024/08/confusion-attacks-en.html
• https://httpd.apache.org/security/vulnerabilities_24.html
• https://security.netapp.com/advisory/ntap-20240712-0001/
• https://github.com/Abdurahmon3236/CVE-2024-38472