CVE-2024-43394 Apache HTTP Server: SSRF on Windows due to UNC paths
Attackers can leak NTLM hashes via SSRF on Windows Apache servers using mod_rewrite or expressions with unvalidated input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-43394?
CVE-2024-43394 is a high-severity server-side request forgery vulnerability in Apache Http Server, published on 10 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via mod_rewrite or apache expressions that pass unvalidated request input.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.63.
Note: The Apache HTTP Server Project will be setting a higher bar for accepting vulnerability reports regarding SSRF via UNC paths.
The server offers limited protection against administrators directing the server to open UNC paths. Windows servers should limit the hosts they will connect over via SMB based on the nature of NTLM authentication.
Weakness: CWE-918
Which versions are affected by CVE-2024-43394?
1 open source package ship an affected version, including apache. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.0 | 2.4.64 |
Products include Apache Http Server.
How do I fix CVE-2024-43394?
Upgrade apache to 2.4.64 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-43394 being exploited?
There is no known exploitation of CVE-2024-43394 in the wild and no public exploit code.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2024-43394, BELL-CVE-2024-43394, BIT-apache-2024-43394, DEBIAN-CVE-2024-43394, GHSA-gxxm-rhpx-j39m, MINI-2hf3-9w8x-wh3h.