Volerion logoVolerion
Volerion logoVolerion

Apache HTTP Server Server-Side Request Forgery Vulnerability on Windows Allowing NTLM Hash Leakage

Vulnerability

A Server-Side Request Forgery (SSRF) vulnerability has been identified in Apache HTTP Server on Windows systems. The issue arises when 'AllowEncodedSlashes' is enabled and 'MergeSlashes' is disabled. This vulnerability allows the potential leakage of NTLM hashes to a malicious server through crafted requests or content. The flaw is present in Apache HTTP Server versions 2.4.0 prior to 2.4.66.

Impact

Exploitation of this vulnerability could lead to unauthorized NTLM hash leakage, which could be used in NTLM relay attacks.

Reproduction

To reproduce this vulnerability, configure Apache HTTP Server on a Windows system with 'AllowEncodedSlashes' set to 'On' and 'MergeSlashes' set to 'Off'. Then, send a request that exploits the SSRF vulnerability by directing it to a server that can capture NTLM hashes.

Remediation

Users are advised to upgrade to Apache HTTP Server version 2.4.66, which addresses this vulnerability.

Added: Dec 5, 2025, 11:19 AM
Updated: Dec 5, 2025, 11:19 AM

Vulnerability Rating

Custom Algorithm
spread
9.4
impact
2.5
exploitability
7.9
remediation
7.7
relevance
1.3
threat
1.6
urgency
2.9
incentive
5.8

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.