CVE-2024-43204: Apache HTTP Server SSRF Vulnerability

CVE-2024-43204 Overview

CVE-2024-43204 is a Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server when mod_proxy is loaded. An attacker can coerce the server to send outbound proxy requests to a URL the attacker controls. Exploitation requires a configuration where mod_headers modifies the Content-Type request or response header using a value supplied in the HTTP request. The Apache HTTP Server project assigned [CWE-918] to this issue and recommends upgrading to version 2.4.64. The vulnerability carries an EPSS probability of 0.684% (71st percentile), indicating moderate exploitation likelihood relative to the broader CVE population.

Critical Impact

An unauthenticated network attacker can force a vulnerable Apache HTTP Server to issue outbound HTTP requests to attacker-chosen destinations, enabling pivoting to internal services and integrity impact on proxied traffic.

Affected Products

• Apache HTTP Server versions prior to 2.4.64 with mod_proxy loaded
• Deployments where mod_headers is configured to set the Content-Type header using a value taken from the HTTP request
• Linux distributions packaging affected Apache builds, including Debian LTS releases referenced in the Debian advisory

Discovery Timeline

• 2025-07-10 - CVE-2024-43204 published to the National Vulnerability Database
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2024-43204

Vulnerability Analysis

The flaw is a classic SSRF condition within Apache HTTP Server's proxy handling. When mod_proxy is loaded and mod_headers is configured to derive the Content-Type header from request-supplied data, an attacker can influence internal request routing. The server can be tricked into issuing outbound proxy requests to a destination chosen by the attacker. This allows the server to act as an unintended proxy relay for the attacker's traffic.

The issue is classified as [CWE-918] Server-Side Request Forgery. Apache classifies the flaw as a confidentiality-neutral, integrity-impacting network vulnerability that requires no authentication or user interaction. The Apache HTTP Server security team addressed the issue in release 2.4.64.

Root Cause

The root cause is that mod_headers directives can reflect attacker-controlled HTTP request values directly into the Content-Type header processed by mod_proxy. The proxy module uses this header value during request routing decisions without sufficient validation. As a result, untrusted input crosses a trust boundary into outbound proxy logic. This violates the expectation that proxy destinations are determined exclusively by server configuration.

Attack Vector

Exploitation is performed remotely over the network. An attacker sends a crafted HTTP request whose contents influence the Content-Type value that mod_headers will set. When mod_proxy subsequently processes the request, the manipulated header steers the proxy toward an attacker-controlled URL. No authentication or user interaction is required. The vulnerability requires the unlikely mod_headers configuration described above, which reduces the population of exploitable deployments. Public proof-of-concept code is not currently listed in Exploit-DB, and the issue is not present on the CISA Known Exploited Vulnerabilities list.

No verified public exploit code is available. Refer to the Apache HTTP Server Vulnerabilities advisory and the Openwall OSS Security discussion for technical details.

Detection Methods for CVE-2024-43204

Indicators of Compromise

• Unexpected outbound HTTP or HTTPS connections originating from Apache HTTP Server worker processes to non-configured destinations
• Apache access_log or error_log entries showing proxied requests to hosts that are not part of the documented backend pool
• HTTP requests containing crafted Content-Type values that match attacker-controlled URL patterns or internal IP ranges

Detection Strategies

• Audit running Apache configurations for the combination of LoadModule proxy_module and Header set Content-Type (or RequestHeader set Content-Type) directives that reference request-derived variables such as %{HTTP:...} or %{...}e
• Inspect web application firewall logs for inbound requests with unusual Content-Type values containing URLs, IP literals, or hostnames pointing to internal infrastructure
• Correlate egress firewall logs with Apache process identifiers to identify outbound requests that bypass intended backend ACLs

Monitoring Recommendations

• Enable verbose mod_proxy logging (LogLevel proxy:info) to record proxy destination decisions for post-incident review
• Monitor for Apache versions below 2.4.64 across the estate using software inventory or vulnerability management tooling
• Alert on outbound connections from web server tiers to cloud metadata endpoints such as 169.254.169.254 and to RFC1918 ranges that are not in the approved backend list

How to Mitigate CVE-2024-43204

Immediate Actions Required

• Upgrade Apache HTTP Server to version 2.4.64 or later on all hosts where mod_proxy is loaded
• Review mod_headers configuration and remove any directive that sets Content-Type from request-supplied values
• Restrict outbound network access from web server tiers using egress firewalls to enforce an allowlist of legitimate backend destinations

Patch Information

The Apache HTTP Server project fixed CVE-2024-43204 in release 2.4.64. Consult the Apache HTTP Server Vulnerabilities advisory for the authoritative fix announcement. Debian users should apply the updates referenced in the Debian LTS Security Announcement. Additional disclosure context is available on the Openwall OSS Security list.

Workarounds

• If immediate upgrade is not feasible, remove or comment out mod_headers directives that populate the Content-Type header from request data
• Unload mod_proxy on servers that do not require reverse-proxy functionality by removing the LoadModule proxy_module directive
• Place a hardened reverse proxy or WAF in front of Apache to strip or normalize incoming Content-Type headers before they reach the vulnerable server

# Configuration example: verify installed Apache version and remove risky mod_headers directives
httpd -v
# Expected output should report Apache/2.4.64 or later

# Search active configuration for risky Content-Type header rewrites
grep -RniE 'Header[[:space:]]+set[[:space:]]+Content-Type|RequestHeader[[:space:]]+set[[:space:]]+Content-Type' /etc/httpd/ /etc/apache2/

# Validate configuration and restart
apachectl configtest && systemctl restart httpd