CVE-2024-43204

What it actually does

SSRF in Apache HTTP Server with mod_proxy loaded allows outbound proxy requests to an attacker-controlled URL when mod_headers is configured to modify the Content-Type header using a value from the HTTP request.

Why it matters to the business

Attackers could potentially reach internal resources or external systems through the web server, increasing risk of data exposure or further attacks, though the required configuration is uncommon and exploitation is not observed in the wild.

How an attack unfolds

An attacker sends a specially crafted HTTP request that causes mod_headers to set Content-Type from attacker input, triggering mod_proxy to forward a request to a URL chosen by the attacker.

How to fix it

Upgrade Apache HTTP Server to version 2.4.64 or apply the fix from commit 7e926454793abd7d71b6afc8bd1ec1648752c6ad; Debian 13 users should update to package version 6.12.35-1. Review and remove unnecessary mod_headers configurations that allow Content-Type to be set from request values.

How to confirm the fix worked

Verify installed Apache version is 2.4.64 or later and confirm mod_headers configuration does not permit Content-Type modification from untrusted request data; test with crafted requests to ensure proxy behavior is not triggered unexpectedly.

Typical attack path

1. Identify Apache HTTP Server instances with mod_proxy enabled and mod_headers configured to derive Content-Type from request data
2. Craft and send HTTP request that supplies attacker-controlled value for the header modification
3. Trigger proxy behavior to issue outbound request to attacker-specified URL
4. Use the SSRF to interact with internal services or external targets

How to detect it

Review web server access logs and proxy logs for unusual outbound requests or requests that appear to manipulate Content-Type headers; look for patterns where request headers influence proxy destinations.

What your security team should do

• Prioritize upgrade to fixed Apache version across all affected deployments
• Audit mod_proxy and mod_headers configurations to eliminate risky header modification patterns
• Monitor EPSS trend and reassess if exploitation maturity changes