High · published December 5, 2025
⚡ A sneaky SSRF vulnerability is lurking in Apache HTTP Server on Windows! With a simple configuration, it could leak your NTLM hashes to a malicious server. 🔥 Think of it as a delivery driver who unwittingly accepts a package to be delivered to a shady address without checking the contents — that’s how this vulnerability could allow attackers to redirect sensitive information right to their door! If exploited, an attacker could potentially access sensitive NTLM hashes, opening the door to further attacks and compromising your network security. This could lead to unauthorized access and possibly devastating data breaches, making it critical to act fast!
Think of it as a delivery driver who unwittingly accepts a package to be delivered to a shady address without checking the contents — that’s how this vulnerability could allow attackers to redirect sensitive information right to their door! This SSRF vulnerability arises from the configuration settings AllowEncodedSlashes On and MergeSlashes Off in Apache, enabling attackers to send crafted requests that could leak sensitive information to an external server.
If exploited, an attacker could potentially access sensitive NTLM hashes, opening the door to further attacks and compromising your network security. This could lead to unauthorized access and possibly devastating data breaches, making it critical to act fast! Upgrade your Apache HTTP Server to version 2.4.66 immediately to close this security hole and ensure that your configuration settings adhere to security best practices. Regularly audit your server configurations to spot potential vulnerabilities like this one. You've got this! Follow these steps and you'll have your server secured in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| apache/http_server | ≥ 2.4.0, < 2.4.66 | 2.4.66 |