CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF

[Eric Covener <covener () apache org>]

Severity: important

Affected versions:

- Apache HTTP Server 2.4.0 through 2.4.59

Description:

SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and 
malicious requests or content 
Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing configurations that access 
UNC paths will have to configure new directive "UNCList" to allow access during request processing.

Credit:

Orange Tsai (@orange_8361) from DEVCORE (finder)

References:

https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-38472

Timeline:

2024-04-01: reported