POC-CVE-2021-41773

POC-CVE-2021-41773 2021年10月5日，发布了一个关于Apache HTTP Server v2.4.49路径遍历攻击的CVE漏洞详情。该漏洞编号为CVE-2021-41773，其描述如下： 在Apache HTTP Server 2.4.49的路径规范化变更中发现了一个缺陷。攻击者可以利用路径遍历攻击，将URL映射到预期文档根目录之外的文件。如果文档根目录之外的文件未受到"require all denied"保护，则这些请求可能成功。此外，此缺陷可能泄露解释性文件（如CGI脚本）的源代码。该问题已知在野外被利用。此问题仅影响Apache 2.4.49，不影响更早版...

CVE-2021-42013

CVE-2021-42013 — PoC：路径遍历 + 通过 modcgi 实现 RCE（绕过补丁） 仅限在受控和自有环境中使用。未经授权不得针对系统使用。 描述 为演示 CVE-2021-42013 而开发的 PoC，该漏洞存在于 Apache HTTP Server 2.4.50 中。 此 CVE 是 Apache 为 CVE-2021-41773 发布的补丁的绕过方式。2.4.50 版本试图通过添加一项拒绝 .%2e 和 %2e. 序列的验证来修复之前的路径遍历漏洞。然而，该验证并不充分：它没有考虑到通过双重 URL 编码 也能达到相同效果，因此留下了相同的攻击面。 与...

linux-apache-fix-mod_rewrite-spaceInURL

修复 Linux Ubuntu Apache modrewrite 中 URL 包含空格的问题 在最近的 Apache 升级后，我在 modrewrite 中遇到了“URL 中包含空格”的问题。 2023-04-25 - 升级 apache2:amd64 2.4.38-3+deb10u9 → 2.4.38-3+deb10u10 包含“空格”且已被替换为 %20 的 URL 开始被 Apache 返回 403 错误。 我发现此次更新实际上是为了修复以下问题：...

Weblogic_Unauthorized-bypass-RCE

CVE-2020–14882 Weblogic 未授权绕过 RCE CVE-2020-14882 Oracle Weblogic 未授权绕过 RCE 测试脚本 支持 Python3 请求 root@kitploit: POST /console/images/%252E%252E%252Fconsole.portal HTTP/1.1 Host: User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/86.0.4240.111 Safari/537.3...

CVE-2021-41773

CVE-2021-41773 演练场 这是一个小型 Docker 搭建方案，用于创建基于 Debian bookworm 的容器，其中运行着存在 CVE-2021-41773 漏洞的 Apache HTTPd 2.4.49 实例。 已显式启用 CGI，因此可用于测试/验证本地文件泄露行为以及远程命令执行行为。 用法 root@kitploit: $ docker-compose build && docker-compose-up 本地文件泄露 root@kitploit: $ curl -s --path-as-is...

Scanner-CVE-2021-41773

Scanner-CVE-2021-41773 针对 Apache 2.4.49 的自动扫描器 root@kitploit: • 运行：go run main.go 或 go build main.go && ./main • 你可以自定义你的 payload • 存在漏洞的主机将被保存 root@kitploit: 搭建你的实验环境： 1. 拉取镜像：sudo docker pull blueteamsteve/cve-2021-41773:no-cgid 2. 运行镜像：sudo docker run -dit -p 8080:80...

CVE-2026-85706-gitlab-poc

CVE-2026-85706 描述 GitLab CE/EE 未认证任意文件读取漏洞（CVE-2026-85706）。 受影响版本： GitLab CE/EE 18.7 – 19.1.7 GitLab CE/EE 19.2.0 – 19.2.5 GitLab CE/EE 19.3.0 – 19.3.1 已修复版本： GitLab 19.1.8 GitLab 19.2.6 GitLab 19.3.2 漏洞详情 该漏洞存在于 GitLab 的 Workhorse 组件中。Workhorse 的正则表达式看到的是编码后的路径，而 Puma 会对其进行解码。Rails 的...

CVE-2021-42013

CVE-2021-42013 贡献者 石恩浩@eunho87 CVE-2021-42013 Apache http服务器路径遍历 漏洞概要 Apache HTTP Server 2.4.50路径规范化处理中存在一个漏洞，可以在无需认证 的情况下读取任意文件或执行远程代码。 该漏洞源于CVE-2021-41773的不完整修补，通过双重URL编码（%%32%65）绕过了Apache的路径拦截。 参考资料 NVD - CVE-2021-42013 Apache Security Advisory 漏洞条件 CVE-2021-42013生效需要满足以下条件： 1. Apache...

CVE-2026-85511

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

CVE-2026-85511

A parameter injection flaw was identified in Red Hat EAP's Elytron security subsystem. Specifically, an EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection allows parameter substitution due to missing URL encoding . The vulnerability is rated MEDIUM...

CVE-2026-85511 Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

EUVD-2026-82946

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

CVE-2026-85511 Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

CVE-2026-85511

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

CVE-2026-85511: Authentication Bypass by Spoofing

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...