important: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (CVE-2024-40898) SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue. Acknowledgements: finder: Smi1e (DBAPPSecurity Ltd.) finder: xiaojunjie (DBAPPSecurity Ltd.) Security Advisory: https://httpd.apache.org/security/vulnerabilities_24.html

Actions:

View on HackerOne

Reported by xi4o7unj1e

Vulnerability Details

Technical details and impact analysis

I reported this vulnerability through the official Apache HTTP Server security email on 2024-07-12, and received a CVE number on 2024-07-17. You can check detailed information from here: https://httpd.apache.org/security/vulnerabilities_24.html ## Impact SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$4263.00