Server-Side Request Forgery (SSRF) kwetsbaarheid in Apache HTTP Server op Windows met AllowEncodedSlashes On en MergeSlashes Off maakt het potentieel mogelijk om NTLM hashes te lekken naar een kwaadwillende server via SSRF en kwaadwillende verzoeken of content Gebruikers wordt geadviseerd te upgraden naar versie 2.4.66, die het probleem oplost.

The SSRF vulnerability in Apache HTTP Server allows an attacker to make requests to internal resources that are otherwise inaccessible. In this specific case, the combination of 'AllowEncodedSlashes On' and 'MergeSlashes Off' creates a scenario where NTLM hashes can be leaked. An attacker could craft a malicious request that triggers the server to send NTLM authentication credentials to a server they control. Successful exploitation could lead to credential theft, enabling further unauthorized access and potentially lateral movement within the network. The blast radius extends to any systems relying on NTLM authentication, making this a significant security concern, particularly in environments with legacy applications.

Organizations running Apache HTTP Server on Windows with versions 2.4.0 through 2.4.66, particularly those with legacy applications relying on NTLM authentication, are at significant risk. Shared hosting environments where users have limited control over server configuration are also vulnerable.

• windows / server:

Get-WinEvent -LogName Security -Filter "EventID = 4625" -ErrorAction SilentlyContinue | Where-Object {$_.Properties[0].Value -like "*ntlm*"}

• apache / server:

grep -r "AllowEncodedSlashes On" /etc/httpd/conf/httpd.conf

• generic web: Check Apache access logs for unusual outbound requests to internal IP addresses or unexpected domains. • generic web: Review Apache configuration files for the presence of 'AllowEncodedSlashes On' and 'MergeSlashes Off'.

1. 2025-12-05Disclosure

   disclosure

1. Gereserveerd2025-09-19
2. Gepubliceerd2025-12-05
3. Gewijzigd2025-12-10
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-59775 is to upgrade Apache HTTP Server to version 2.4.66 or later, which includes the fix. If an immediate upgrade is not feasible due to compatibility issues or downtime constraints, consider temporarily disabling the 'AllowEncodedSlashes' directive. Alternatively, ensure 'MergeSlashes' is set to 'On' to prevent the vulnerability. Web Application Firewalls (WAFs) can be configured to filter requests containing suspicious URL patterns that might exploit the SSRF vulnerability. Monitor Apache access and error logs for unusual outbound requests to internal or unexpected external resources. Sigma rules or YARA patterns can be developed to detect malicious request patterns associated with this SSRF vulnerability.