SSRF in Apache HTTP Server on Windows Leading to NTLM Hash Leakage

Successful exploitation can cause disclosure of NTLM authentication material from the vulnerable Windows host to an attacker-controlled server. This may expose credential hashes that can be used for credential theft, relay, or further lateral movement depending on the surrounding environment and authentication controls. The primary impact described is confidentiality loss rather than direct code execution.

If immediate upgrade is not possible, reduce exposure by avoiding the vulnerable configuration combination on Windows systems, specifically by not enabling AllowEncodedSlashes together with disabling MergeSlashes unless strictly required. Limit the ability of untrusted users or upstream content sources to supply attacker-controlled paths or content that could trigger outbound requests, and restrict outbound authentication and network access from the web server to untrusted destinations where feasible. Monitoring for unexpected outbound SMB or related authentication traffic from the server may also help detect exploitation attempts.

Upgrade Apache HTTP Server to version 2.4.66 or later. The fixed release addresses the SSRF condition that can lead to NTLM hash leakage on affected Windows installations.