CVE-2024-43204·Apache vulnerability

Affected versions

How to fix this CVE

Upgrade Apache HTTP Server to version 2.4.64 or later to address this Server-Side Request Forgery (SSRF) vulnerability. Organizations running Apache with mod_proxy enabled should prioritize this update, particularly if mod_headers is configured to process user-controlled Content-Type headers. This vulnerability allows attackers to manipulate proxy requests to reach internal or external targets when specific header configurations are present.

sudo dnf update httpd

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

GET|POST|HEAD request with crafted Content-Type header containing external URLs (e.g., http:// or https://) followed by proxy response status codes (200, 301, 302) to non-standard ports; regex: (Content-Type:.*http[s]?://[^\s]+|X-Forwarded-.*http[s]?://[^\s]+)

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Configure WAF rules to block HTTP requests with suspicious Content-Type or X-Forwarded-* headers containing URL schemes (http://, https://, ftp://). Implement strict header validation to reject requests where these headers contain values other than standard MIME types. Restrict access to proxy endpoints to trusted internal networks only.

How to check if you are affected

1. Step 1: Check Apache version by running: apache2ctl -v (Ubuntu/Debian) or httpd -v (RHEL/CentOS). Compare against 2.4.64 — versions below this are vulnerable.
2. Step 2: Verify if mod_proxy is loaded: grep -i 'mod_proxy' /etc/apache2/mods-enabled/*.conf (Ubuntu/Debian) or /etc/httpd/modules/ (RHEL/CentOS). If present and mod_headers is also enabled, your configuration is at risk.
3. Step 3: Search Apache access and error logs for unusual outbound proxy requests: grep -i 'proxy' /var/log/apache2/access.log | grep -E '(http://|https://)' to identify potential exploitation attempts.
4. Step 4: After upgrading, confirm the version: apache2ctl -v or httpd -v should display 2.4.64 or higher, and restart Apache with: sudo systemctl restart apache2 (Ubuntu/Debian) or sudo systemctl restart httpd (RHEL/CentOS).

FAQ

Related Apache CVEs

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• http://www.openwall.com/lists/oss-security/2025/07/10/2
• http://www.openwall.com/lists/oss-security/2025/07/10/4
• https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html