Threats tagged 'ghsa-gxxm-rhpx-j39m'

A Server-Side Request Forgery (SSRF) vulnerability exists in Apache HTTP Server on Windows platforms, affecting versions from 2.4.0 through 2.4.63. This flaw allows attackers to potentially leak NTLM hashes to a malicious server by exploiting mod_rewrite or Apache expressions that process unvalidated request input. The vulnerability involves the server making unauthorized SMB connections to attacker-controlled UNC paths, risking credential exposure. Apache HTTP Server provides limited protection against such attacks, and administrators are advised to restrict SMB host connections to mitigate risk.