CVE-2024-43204: Apache HTTP Server SSRF Vulnerability

CVE-2024-43204 Overview

A Server-Side Request Forgery (SSRF) vulnerability exists in Apache HTTP Server when mod_proxy is loaded. This flaw allows an attacker to send outbound proxy requests to a URL controlled by the attacker. The vulnerability requires an unlikely but specific configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request. Users are recommended to upgrade to version 2.4.64 which fixes this issue.

Critical Impact

Attackers can exploit this SSRF vulnerability to force the Apache HTTP Server to make outbound requests to arbitrary URLs, potentially accessing internal services, exfiltrating data, or pivoting to attack internal network resources.

Affected Products

• Apache HTTP Server (versions prior to 2.4.64)

Discovery Timeline

• 2025-07-10 - CVE CVE-2024-43204 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2024-43204

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The SSRF condition arises when Apache HTTP Server has both mod_proxy loaded and a specific mod_headers configuration that allows header manipulation based on user-supplied input. When mod_headers is configured to modify the Content-Type header using values from the HTTP request, an attacker can inject malicious URLs into the proxy request flow.

The vulnerability enables attackers to manipulate the server into initiating HTTP requests to arbitrary destinations. This can be leveraged to probe internal network services that would otherwise be inaccessible from external networks, potentially bypassing firewalls and network segmentation controls.

Root Cause

The root cause lies in the interaction between mod_proxy and mod_headers when configured in a specific manner. When mod_headers is set to modify Content-Type headers using request-supplied values, the mod_proxy module may inadvertently use this attacker-controlled data to determine outbound proxy request destinations. This configuration gap allows request parameters to influence the proxy target URL without proper validation or sanitization.

Attack Vector

The attack is network-based and can be executed remotely without authentication. An attacker crafts malicious HTTP requests containing attacker-controlled URLs in header values that are subsequently processed by mod_headers. When the server processes these requests, it triggers mod_proxy to make outbound connections to the specified URLs.

The attack scenario requires the target server to have:

1. mod_proxy module loaded
2. mod_headers configured to modify Content-Type headers using request-supplied values

While this specific configuration is described as "unlikely," organizations using complex proxy configurations should verify their Apache configurations against this vulnerability pattern.

Detection Methods for CVE-2024-43204

Indicators of Compromise

• Unusual outbound HTTP/HTTPS connections from the Apache web server to internal IP ranges or unexpected external hosts
• Spike in proxy-related error messages in Apache error logs indicating connection attempts to non-standard destinations
• Requests containing suspicious Content-Type header manipulations or URL patterns in access logs
• Network traffic showing the web server initiating connections to internal services or metadata endpoints

Detection Strategies

• Configure network monitoring to alert on outbound connections from web servers to internal networks or cloud metadata services (e.g., 169.254.169.254)
• Implement log analysis rules to detect requests with anomalous header patterns, particularly Content-Type headers containing URL-like values
• Deploy web application firewalls (WAF) with SSRF detection rules to identify and block malicious request patterns
• Use SentinelOne Singularity platform to monitor for suspicious process behavior and network connections originating from Apache processes

Monitoring Recommendations

• Enable detailed access logging including all request headers to capture potential exploitation attempts
• Monitor Apache error logs for proxy-related errors indicating failed connection attempts to unexpected destinations
• Implement egress filtering and alerting for connections from web servers to restricted network segments
• Regularly audit mod_headers and mod_proxy configurations for potentially dangerous header manipulation rules

How to Mitigate CVE-2024-43204

Immediate Actions Required

• Upgrade Apache HTTP Server to version 2.4.64 or later immediately
• Audit current mod_headers configurations and remove or restrict any rules that modify headers using user-supplied request values
• Review mod_proxy configurations and ensure proper access controls are in place
• Implement network egress filtering to restrict outbound connections from web servers to only necessary destinations

Patch Information

Apache Software Foundation has released version 2.4.64 which addresses this SSRF vulnerability. Organizations should apply this update as their primary remediation strategy. For detailed information about the fix and other security updates, refer to the Apache HTTP Server Vulnerabilities page. Additional security discussion is available via Openwall OSS Security Update #2 and the Debian LTS Security Announcement.

Workarounds

• If immediate patching is not possible, review and modify mod_headers directives to avoid using request-supplied values for header modifications
• Disable mod_proxy if it is not required for the application's functionality
• Implement strict egress firewall rules to limit outbound connections from the web server to only whitelisted destinations
• Configure mod_proxy with explicit allow lists for permitted proxy destinations

# Configuration example - Review and restrict mod_headers directives
# Before (potentially vulnerable):
# Header set Content-Type "%{Content-Type}i"

# After (safer configuration):
# Remove or restrict header manipulation based on user input
# Verify mod_proxy access controls

# Check loaded modules
apachectl -M | grep -E "(proxy|headers)"

# Review mod_headers configuration files
grep -r "Header.*%{" /etc/apache2/
grep -r "RequestHeader.*%{" /etc/apache2/