CVE-2024-43394

What it actually does

SSRF via unvalidated request input in mod_rewrite or Apache expressions allows the server on Windows to initiate SMB connections to attacker-controlled UNC paths, resulting in NTLM hash leakage.

Why it matters to the business

Attackers may obtain Windows credentials that enable lateral movement or privilege escalation inside the network; the flaw affects all Windows deployments of the server from version 2.4.0 onward and requires prompt patching to prevent credential theft.

How an attack unfolds

An attacker supplies crafted request data that reaches mod_rewrite rules or expression evaluations, causing the server to attempt an SMB connection to a malicious UNC path; the resulting NTLM authentication attempt leaks hashes to the attacker-controlled host.

How to fix it

Upgrade Apache HTTP Server on Windows to a build containing commit 7e926454793abd7d71b6afc8bd1ec1648752c6ad or later; restrict SMB outbound connections from the server to only trusted hosts and disable NTLM where possible.

How to confirm the fix worked

Confirm the installed version is newer than 2.4.63 and contains the referenced commit; test by submitting requests that would previously trigger UNC connections and verify they are now rejected or logged as blocked.

Typical attack path

1. Identify a vulnerable Apache instance on Windows that uses mod_rewrite or expressions processing user-controlled input
2. Craft a request containing a UNC path that triggers an outbound SMB connection
3. Receive the NTLM authentication attempt and capture or relay the hashes
4. Use the obtained hashes for further attacks such as pass-the-hash or credential stuffing

How to detect it

Review web server access and error logs for requests containing UNC paths or backslashes; inspect Windows event logs and network flows for unexpected SMB connections or NTLM authentication attempts originating from the Apache process.

• UNC paths containing \\ in request URIs or rewrite targets
• Outbound SMB traffic (port 445) from httpd.exe or apache.exe
• NTLMSSP authentication packets with target names matching attacker-controlled hosts

What your security team should do

• Apply the fixed commit or subsequent release immediately on all Windows installations
• Audit mod_rewrite rules and expression usage for any unvalidated external input
• Implement network controls limiting SMB traffic from web servers to untrusted destinations
• Monitor for unexpected outbound SMB or NTLM authentication events from the server