CVE-2024-43394
Apache HTTP Server: SSRF on Windows due to UNC paths
概要
Apache HTTP Server: SSRF on Windows due to UNC paths
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via
mod_rewrite or apache expressions that pass unvalidated request input.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.63.
Note: The Apache HTTP Server Project will be setting a higher bar for accepting vulnerability reports regarding SSRF via UNC paths.
The server offers limited protection against administrators directing the server to open UNC paths.
Windows servers should limit the hosts they will connect over via SMB based on the nature of NTLM authentication.
影響パッケージ
Bitnami
apache
[{"type":"SEMVER","events":[{"introduced":"2.4.0"},{"fixed":"2.4.64"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2024-43394 apache2 修正版: 2.4.64-r0
- Debian DEBIAN-CVE-2024-43394 apache2 修正版: 2.4.65-1~deb11u1
参照URL
- advisory httpd.apache.org
- web nvd.nist.gov
- web openwall.com
- web openwall.com
- web lists.debian.org