Listen to this Post
This vulnerability is a Server-Side Request Forgery (SSRF) specific to the Apache HTTP Server running on the Windows operating system. The exploit requires a non-default server configuration where the `AllowEncodedSlashes` directive is set to `On` and the `MergeSlashes` directive is set to Off. Under these conditions, an attacker can craft a malicious HTTP request containing a specially formatted UNC (Universal Naming Convention) path (e.g., \\malicious-server\share). When the Apache server processes this request, it interprets the UNC path and attempts to connect to the specified network share. During this connection attempt, the Windows system automatically initiates an SMB authentication handshake with the attacker-controlled server. This process causes the vulnerable system to send its NTLM authentication hash, which is a cryptographic representation of the user’s password, to the malicious server. The attacker can capture this hash and then attempt to crack it offline to obtain plaintext credentials or use it directly in a pass-the-hash attack to gain unauthorized access to other network resources that trust the compromised account.
Platform: Apache HTTP Server Windows
Version: Through 2.4.65
Vulnerability: SSRF UNC Path
Severity: High 7.5
date: December 5 2025
Prediction: Patched December 4 2025
What Undercode Say:
Check Apache version on Windows httpd.exe -v Check for vulnerable configuration in httpd.conf findstr "AllowEncodedSlashes On" httpd.conf findstr "MergeSlashes Off" httpd.conf
How Exploit:
An attacker sends an HTTP request with a UNC path to the vulnerable Apache server. The server, misconfigured with `AllowEncodedSlashes On` and MergeSlashes Off, interprets the path and initiates an SMB connection to an attacker-controlled IP address. This triggers Windows to send the server machine’s NTLMv2 hash, which the attacker captures for offline cracking or relay attacks.
Protection from this CVE
Upgrade to Apache version 2.4.66.
Avoid setting `AllowEncodedSlashes On` with `MergeSlashes Off` on Windows.
Restrict outbound SMB connections from web servers.
Impact
Potential leakage of Windows NTLM authentication hashes, leading to credential compromise, lateral movement within the network, and unauthorized access to sensitive resources.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
