CVE-2024-43394·Apache vulnerability

Affected versions

How to fix this CVE

Upgrade Apache HTTP Server to version 2.4.64 or later to patch the SSRF vulnerability that could expose NTLM credential hashes on Windows systems. The vulnerability exists in mod_rewrite and Apache expression handlers that process unvalidated user input without proper sanitization. Windows administrators should prioritize this patch and restrict outbound SMB connections at the firewall level as a defense-in-depth measure.

sudo dnf update httpd

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

GET|POST requests containing encoded or literal UNC path patterns (\\\\servername\\share or %5c%5cservername%5c) in mod_rewrite rules, or request parameters that reference file:// URIs or SMB protocol handlers in Apache expression evaluations

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement input validation rules that reject requests containing UNC path syntax (backslash sequences, file:// schemes) in query parameters and request bodies that are evaluated by mod_rewrite. Deploy rate-limiting on requests to prevent credential hash leakage attempts. Block outbound SMB (port 445) connections from the web server at the network level.

How to check if you are affected

1. Step 1: Check Apache version with 'apache2ctl -v' (Debian/Ubuntu) or 'httpd -v' (RHEL/CentOS/Amazon Linux) and confirm it is below 2.4.64
2. Step 2: Verify mod_rewrite is enabled by running 'apache2ctl -M | grep rewrite' and check for rewrite rules that accept user input in REQUEST_URI or QUERY_STRING
3. Step 3: Search Apache access and error logs for patterns like 'UNC', 'file://', or unusual SMB connection attempts using 'grep -i "\\\\\\" /var/log/apache2/access.log' on Windows systems
4. Step 4: After patching, re-run 'apache2ctl -v' or 'httpd -v' to confirm version is 2.4.64 or higher and restart Apache with 'sudo systemctl restart apache2' or 'sudo systemctl restart httpd'

FAQ

Related Apache CVEs

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• http://www.openwall.com/lists/oss-security/2025/07/10/2
• http://www.openwall.com/lists/oss-security/2025/07/10/5
• https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html