oss-security - CVE-2024-40898: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <0c68c79b-0282-398c-8e96-3eb19d9f1bc2@apache.org>
Date: Wed, 17 Jul 2024 18:25:03 +0000
From: Eric Covener <covener@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-40898: Apache HTTP Server: SSRF with mod_rewrite in
 server/vhost context on Windows 

Severity: important

Affected versions:

- Apache HTTP Server 2.4.0 through 2.4.61

Description:

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.

Users are recommended to upgrade to version 2.4.62 which fixes this issue.

Credit:

Smi1e (DBAPPSecurity Ltd.) (finder)

References:

https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-40898

Timeline:

2024-07-12: reported

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.