CVE-2014-6271

Shellshock Exploitation CVE-2014-6271 Shellshock is effectively a Remote Command Execution vulnerability in BASH. This script exploits the vulnerability in the web environment on apache or similar with modcgi enabled. The vulnerability lies in the manipulation of environment variables, which are...

CVE-2021-42013

CVE-2021-42013 — PoC: Path Traversal + RCE via modcgi patch bypass For use only in controlled and own environments. Do not use against systems without authorization. Description PoC developed to demonstrate CVE-2021-42013 , present in Apache HTTP Server 2.4.50. This CVE is the bypass of the patch...

CVE-2021-41773

CVE-2021-41773 — PoC: Path Traversal + RCE via modcgi For use only in controlled and own environments. Do not use against systems without authorization. Description PoC developed to demonstrate and understand the vulnerability CVE-2021-41773 , present in Apache HTTP Server 2.4.49. The flaw reside...

CVE-2021-41773

CVE-2021-41773 CVE-2021-41773 According to The National Vulnerability Database NVD CVE-2021-41773, Apache HTTP Server 2.4.49 is vulnerable to Path Traversal and Remote Code execution attacks. Path Traversal The path traversal vulnerability was introduced due to the new code change added for path...

CVE-2021-41773

RCE exploit both for Apache 2.4.49 CVE-2021-41773 and 2.4.50 CVE-2021-42013: IMHO only "special" setups will be vulnerable to this RCE. Same happens for the "arbitrary file read" exploits you have seen. Both CVEs are indeed almost the same path-traversal vulnerability 2nd one is the uncomplete fi...

PoC-Apache-CVE-2021-41773-Infrastructure-LAB

Apache CVE-2021-41773 — Lab Docker PoC Security Notice This repository reproduces a publicly disclosed and patched vulnerability in a controlled Docker lab environment for educational and research purposes. The environment is intentionally vulnerable and must only be deployed in isolated test...

CVE-2021-41773

Apache 2.4.49 Path Traversal + Remote Code Execution CVE-2021-41773 Vulnerability Description This vulnerability affects versions of Apache HTTP Server 2.4.49. A path validation error allows remote attackers to perform Path Traversal using sequences like .%2e/ to access paths outside the configur...

apache_2.4.50

Apache HTTP Server 2.4.50 LFI & RCE A python3 script for the CVE-2021-42013 - Apache HTTP Server 2.4.50 LFI & RCE. RCE requires cgi-bin to be enabled Getting Started Executing program LFI python3 apache2.4.50.py -t http://apache.hack/ -lfi /etc/passwd RCE python3 apache2.4.50.py -t...

CVE-2021-41773

CVE-2021-41773 — Apache HTTP Server 2.4.49 Path Traversal & RCE ⚠️ For isolated, educational lab use ONLY. This repository builds a deliberately vulnerable Apache server. Never run it on a live, production, or internet-facing host. Red Team internship project by Team Alpha ITSOLERA — Offensive...

Exploit for Path Traversal in Apache Http_Server

Apache HTTP Server 2.4.50 Path Traversal and RCE CVE-2021-420...

CVE-2021-42013

CVE-2021-41773 / CVE-2021-42013 Apache Vulnerability Scanner A comprehensive Python-based vulnerability scanner for detecting CVE-2021-41773 and CVE-2021-42013 path traversal and remote code execution vulnerabilities in Apache HTTP Server versions 2.4.49 and 2.4.50. Overview CVE-2021-41773 and...

CVE-2021-41773

CVE-2021-41773 This is a simple poc for Apache Path Traversal Vulnerability Vulnerable versions: Apache/2.4.49 Apache/2.4.50 with modcgi disabled...

cve-2021-41773-exploration

Overview CVE-2021-41773 is a path traversal vulnerability discovered in Apache HTTP Server 2.4.49 in October 2021. The root cause was a failure to properly normalize dot sequences ended into the URL before checking whether requested path stayed within the web root. This vulnerability allowed an...

CVE-2021-41773

Apache HTTP Server 2.4.49 - Path Traversal & RCE CVE-2021-41773 A sophisticated Python-based proof-of-concept PoC exploit for CVE-2021-41773. This tool automates the process of testing Apache 2.4.49 servers for path traversal and remote code execution RCE vulnerabilities. ⚠️ Legal Disclaimer This...

CVE-2021-41773

CVE-2021-41773 — Apache Path Traversal & RCE Exploitation Writeup of the TryHackMe "Modern Web Stacks" room, focused on exploiting CVE-2021-41773 , a path traversal vulnerability in Apache HTTP Server 2.4.49 that leads to remote code execution when modcgi is enabled. Summary Item| Detail ---|---...

information_security_-expert-Blind-SSRF-with-Shellshock-exploitation

Blind SSRF with Shellshock exploitation — 로컬 도커 재현 랩 정보보호 수업...

Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49 and 2.4.50. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests ca...

Security Bulletin:Incorrect Authorization Vulnerability: Unauthenticated Access to CGI Scripts Protected by Directory Rules via script_alias in Erlang OTP (inets modules)

Summary Incorrect Authorization vulnerability in Erlang OTP inets modules allows unauthenticated access to CGI scripts protected by directory rules when served via scriptalias. When scriptalias maps a URL prefix to a directory outside DocumentRoot, modauth evaluates directory-based access control...

Qnap QTS Bash OS Command Injection (CVE-2014-7169)

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the...

Apache Mod_cgi Bash Environment Variable Injection (Shellshock) Scanner

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache modcgi Bash Environment Variable Injection Shellshock Scanner', 'Description' = %q This module scans for the Shellshock vulnerability, a...