Description
A vulnerability exists in Apache HTTP Server 2.4.48 and earlier versions, specifically within the mod_proxy module. An attacker can exploit this flaw by crafting a request uri-path in a way that causes mod_proxy to forward the request to an origin server chosen by the remote user. This vulnerability can lead to Server-Side Request Forgery (SSRF) attacks, enabling attackers to interact with internal systems or services that are not directly accessible to them.
Recommendation
To mitigate this vulnerability, it is recommended to update the Apache HTTP Server to the latest available version.
References
Could your website be exposed too?
SmartScanner can check your website for Apache mod_proxy 2.4.48 SSRF and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Apache 2.4.49 Path Traversal and RCE - CVE-2021-41773, CVE-2021-42013
- SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl - CVE-2026-46372
- SillyTavern has a SSRF vulnerability in the CORS proxy middleware - CVE-2026-44652
- Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF - CVE-2025-62718
You might also like:
See something that needs correcting? Let us knowUpdated May 13, 2024