cve-2021-41773-checker

🛑 CVE-2021-41773 Checker CVE-2021-41773 Checker is a Python-based CLI tool that checks whether a target web server is vulnerable to the Apache path traversal vulnerability affecting Apache HTTP Server 2.4.49. It is designed as a learning-focused proof of concept for understanding how CVEs are...

CVE-2021-41773-apache

CVE-2021-41773 Apache HTTP Server Exploit This repository contains a Python-based proof-of-concept exploit for the Apache HTTP Server path traversal vulnerability identified as CVE-2021-41773. The script is designed for security research, defensive testing, and authorized evaluations of vulnerabl...

cve-2021-41773-docker-lab

Lab CVE-2021-41773 Container lab to play/learn with CVE-2021-41773 File disclosure: root@kitploit: $ docker build -t apache-default defaultconf $ docker run -dit --name apache-app -p 81:80 apache-default PoC root@kitploit: curl -s --path-as-is...

CVE-2026-23918-Elite-Auditor

☣️ CVE-2026-23918-Elite-Auditor ☣️ 针对 Apache HTTP/2 双重释放漏洞的专业情报与侦察工具。 📌 概述 CVE-2026-23918 （CVSS 8.8）是 Apache HTTP Server 2.4.66 中的一个严重内存损坏缺陷。该审计工具旨在安全地对目标进行指纹识别并评估风险暴露程度，尤其适用于版本字符串被混淆或被 WAF 屏蔽的环境。 🚀 主要特性 特性| 描述 ---|--- ALPN 协议强制| 强制进行 HTTP/2 握手以验证引擎激活状态 WAF/代理绕过| 针对直接源 IP 审计进行优化，以绕过...

CVE-2026-23918-test

CVE-2026-23918-test 本仓库包含一个概念验证（PoC），用于演示 Apache HTTP Server 2.4.66 modhttp2 中的双重释放（Double Free）漏洞（CVE-2026-23918）。 该漏洞源于早期 RSTSTREAM 帧处理过程中的竞态条件。我专注于会话处理器和后端工作线程同时尝试清除流内存池的时间窗口，导致 APR 分配器中发生双重释放。 当前进展 崩溃触发：已在本地成功触发竞态条件。Apache 子进程以段错误（Segmentation fault，信号 11）终止。 拒绝服务状态：在此阶段，PoC...

CVE-2024-40898-SSL-Bypass-Detection

CVE-2024-40898 SSL Certificate Validation Bypass Scanner This repository contains a Python-based proof-of-concept PoC script to detect CVE-2024-40898, a vulnerability in Apache HTTP Server that allows attackers to bypass SSL certificate verification. Overview CVE-2024-40898 is a security issue in...

CVE-2021-40438

CVE-2021-40438 Requesting a uri-path can cause modproxy to forward the request to an origin server selected by a remote user. This issue affects Apache HTTP Server 2.4.48 and earlier versions. Attackers can exploit this vulnerability by crafting a request with a uri-path, which causes modproxy to...

Exploit for Improper Handling of Highly Compressed Data (Data Amplification) in Apache Http_Server

!Go Versionhttps://img.shields.io/badge/Go-1.26%2B-00ADD8?lo...

apache-vulnerability-testing

Apache HTTP Server 漏洞测试工具 该仓库提供了一个概念验证（PoC） ，用于测试 Apache HTTP Server 中的各种漏洞，包括文件名混淆攻击、SSRF、拒绝服务以及其他与近期 CVE 相关的漏洞。该工具会发送精心构造的 HTTP 请求，以评估服务器是否容易受到某些类型的攻击。 功能 测试多种漏洞，包括： CVE-2024-38472 : Windows 上 Apache HTTP Server 的 UNC SSRF CVE-2024-39573 : modrewrite 代理处理器替换 CVE-2024-38477 : modproxy 中导致拒绝服务的崩溃...

cve-2021-41773-lab

CVE-2021-41773 — Minimal FastAPI Lab A small, self-contained FastAPI lab demonstrating how decoding user input before validating filesystem boundaries can lead to directory traversal and local file inclusion LFI, modeled after the Apache HTTP Server issues CVE-2021-41773. Features Minimal,...

CVE-2021-41773

CVE-2021-41773 Docker root@kitploit: $ sudo docker build -t . $ sudo docker run -d -t -p 80:80 --name /bin/bash $ sudo docker exec -it ./bin/apachectl -k restart 访问 Docker 容器以修改自定义配置文件 root@kitploit: $ docker exec -it /bin/bash 配置文件位于 /usr/local/apache2/conf/httpd.conf 修改配置后运行命令 $...

cve-2021-41773-source-code-analysis

Apache HTTP Server CVE-2021-41773 Source Code Analysis A Python-based static patch analysis tool for studying the root cause and remediation of CVE-2021-41773 Apache HTTP Server Path Traversal by comparing the vulnerable Apache HTTP Server 2.4.49 source code with the patched 2.4.51 implementation...

CVE-2024-40275_Scanner

CVE-2024-40725 扫描器 一个基于 Python 的检测工具，用于 CVE-2024-40725 ，这是一个影响 2.4.0 和 2.4.61 版本的 Apache HTTP Server 源代码泄露漏洞。 法律声明： 仅可对您拥有或已获得明确书面授权进行测试的服务器运行此扫描器。未经授权使用可能违反计算机欺诈法律（例如 CFAA、Computer Misuse Act）。 背景 CVE-2024-40725 是 Apache 内部请求管道中的一个回归问题，该问题在 2.4.0 版本中引入（是对 CVE-2024-39884 的不完整修复）。当服务器使用旧式 AddType...

cve-2021-41773

CVE-2021-41773 CVE-2021-41773: Path Traversal Zero-Day in Apache HTTP Server Exploited Apache HTTP Server CVE-2021-41773 Exploited in the Wild CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 incomplete fix of CVE-2021-41773 Shodan oneliner...

CVE-2024-40725

HTTP Request Smuggling Detection Tool This repository contains a Python-based tool to detect HTTP Request Smuggling vulnerabilities, specifically targeting CVE-2024-40725. The tool attempts to exploit this vulnerability in Apache HTTP Server by sending crafted HTTP requests and analyzing the...

CVE-2021-41773

CVE-2021-41773 Usage root@kitploit: docker-compose up -d --build vuln-server-no-cgid python no-cgid/exploit.py root@kitploit: docker-compose up -d --build vuln-server-cgid-sh python cgid-sh/exploit.py What is CVE-2021-41773? CVE-2021-41773 Directory traversal vulnerability in Apache HTTP Server...

CVE-2021-41773

CVE-2021-41773 This is a simple poc for Apache Path Traversal Vulnerability Vulnerable versions: Apache/2.4.49 Apache/2.4.50 with modcgi disabled...

CVE-2021-41773

CVE-2021-41773 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 Usage root@kitploit: python3 apache2-4-49.py -h python3 apache2-4-49.py --check --single example.com Reference...

CVE-2021-41773-Apache-RCE

CVE-2021-41773-Apache-RCE A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected b...

MiracleLinux 8 : httpd:2.4 (AXSA:2026-1840:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1840:01 advisory. httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 Tenable has...