Description

CVE-2024-40898 is a Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with mod_rewrite in the server/vhost context. This vulnerability allows an attacker to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. The CVSS score of 7.5 indicates a high severity, while the SOCRadar Vulnerability Risk Score (SVRS) of 74 signifies a critical vulnerability requiring immediate action.

Key Insights

• Active Exploitation: This vulnerability is actively exploited in the wild, posing an immediate threat to organizations.
• NTLM Hash Leakage: The vulnerability allows attackers to leak NTML hashes, which can be used to compromise Active Directory accounts and gain access to sensitive data.
• Windows-Specific: This vulnerability only affects Apache HTTP Server on Windows systems, making it a targeted attack vector for attackers.
• CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about this vulnerability, urging organizations to take immediate action.

Mitigation Strategies

• Upgrade Apache HTTP Server: Upgrade to Apache HTTP Server version 2.4.62 or later, which fixes this vulnerability.
• Disable mod_rewrite: If upgrading is not immediately possible, disable mod_rewrite in the server/vhost context to mitigate the vulnerability.
• Implement Web Application Firewall (WAF): Deploy a WAF to block malicious requests and prevent exploitation of this vulnerability.
• Monitor for Suspicious Activity: Monitor logs and network traffic for any suspicious activity that may indicate exploitation attempts.

Additional Information

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.