Apache HTTP Server mod_proxy SSRF

This repository contains a proof-of-concept exploit for CVE-2021-40438, a server-side request forgery (SSRF) vulnerability in Apache HTTP Server 2.4.48 and earlier. The repository consists of two files: a README.md with usage instructions and a Python script (exploit.py) that performs the exploit. The script takes a target URL (the vulnerable Apache server), an SSRF target URL (the internal or external resource to be fetched by the server), and an optional HTTP proxy. It crafts a GET request to the vulnerable server with a specially constructed path that triggers the SSRF via mod_proxy. The exploit is straightforward, does not include a customizable payload beyond the SSRF target, and is intended for educational and testing purposes only. No hardcoded endpoints are present; all targets are supplied by the user at runtime.

This repository contains a Python exploit targeting Check Point Security Gateways, specifically versions R81.10 T335 and R80.40 T294, exploiting CVE-2021-40438. The main script, 'check_point_gateways_rce.py', provides three modes: 'dump' (extracts sensitive configuration data), 'reset' (resets the admin password), and 'exec' (resets the password and executes arbitrary commands via the Gaia API). The exploit works by abusing a mod_proxy path traversal vulnerability, allowing the attacker to interact with internal UNIX sockets through crafted HTTP(S) requests. The codebase is organized with utility modules for password hashing and monkey-patching HTTP libraries to allow special characters in URLs. The exploit is operational and provides real impact, including full administrative access and remote command execution on vulnerable gateways. The endpoints '/gaia_docs?unix:/tmp/xdumps|http://.' and '/gaia_docs?unix:/tmp/xsets|http://.' are used for the main exploit actions, while '/gaia_api/login' and '/gaia_api/run-script' are used for post-exploitation via the Gaia API.

This repository provides a proof-of-concept (PoC) exploit for CVE-2021-40438, a server-side request forgery (SSRF) vulnerability in Apache HTTP Server 2.4.48. The repository contains three files: a Dockerfile to build a vulnerable Apache server, an Apache configuration file (exploit.conf.txt), and a README.md with detailed instructions. The exploit works by sending a specially crafted HTTP request to the running Apache server (via Docker), which causes the server to make a request to an attacker-specified URL. The README demonstrates how to build and run the Docker container and how to craft the exploit request using curl. The main purpose of the repository is to provide a safe, reproducible environment for testing and demonstrating the SSRF vulnerability in Apache HTTP Server.

This repository is a Python-based scanner for CVE-2021-40438, a Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server's mod_proxy module (versions <=2.4.48). The tool is structured as a command-line utility with a main entry point in 'cve202140438/main.py'. It allows users to scan single URLs or lists of URLs for the vulnerability. The scanner works by fetching a list of SSRF payload endpoints from a remote GitHub resource and appending them to the target URL, then checking for specific response signatures that indicate vulnerability. If a vulnerable endpoint is found, it outputs the PoC URL and can optionally send a notification via Telegram (if configured). The tool also provides options to save results to a file and to read more about the vulnerability via a blog link. The codebase is modular, with separate files for scanning logic, file reading, Telegram notification, configuration management, and utility functions. No exploit payload is delivered beyond the SSRF scan itself, making this a proof-of-concept scanner rather than a weaponized exploit.

This repository contains two Python proof-of-concept (POC) scripts and a README for exploiting CVE-2021-40438, an SSRF vulnerability in Apache HTTP Server's mod_proxy (versions 2.4.48 and earlier). The vulnerability allows an attacker to craft a special URI path that causes the server to make requests to arbitrary attacker-controlled endpoints. - The main scripts are 'poc.py' (single target) and 'POC批量.py' (batch mode). Both construct a long URI with a payload that abuses the SSRF flaw, appending a pipe ('|') and a remote URL (e.g., http://www.baidu.com/ or http://{{DNS.ceye.io}}/) to the request. - 'POC批量.py' reads a list of hosts from 'host.txt', sends the exploit request to each, and logs successful SSRF attempts to 'success.txt'. It uses the presence of the string '百度' in the response to confirm success. - 'poc.py' is a minimal version for a single host, checking for a 200 OK response. - The README provides background on the vulnerability and remediation steps. The exploit demonstrates the ability to trigger SSRF and can be used for both direct and out-of-band detection (using DNS logging services like ceye.io). No weaponized or post-exploitation payloads are included; the scripts are POCs for vulnerability verification.

This repository contains a Python proof-of-concept exploit for CVE-2021-40438, a critical SSRF vulnerability in Apache HTTP Server 2.4.48 and earlier. The main file, CVE-2021-40438.py, allows an attacker to send a specially crafted HTTP GET request to a vulnerable Apache server, causing it to make a server-side request to an arbitrary URL controlled by the attacker. The exploit takes two command-line arguments: the target server URL and the webhook (attacker's endpoint) URL. The README provides usage instructions, example commands, and context about the vulnerability. The exploit is straightforward, does not include a post-exploitation payload, and is intended for demonstration and testing purposes. No hardcoded endpoints are present in the code, but example endpoints are provided in the documentation.

This repository provides a proof-of-concept (POC) exploit for CVE-2021-40438, a vulnerability in Apache HTTP Server 2.4.48 and earlier that allows a remote attacker to force the server to forward requests to an arbitrary origin server (SSRF via mod_proxy). The repository contains a simple Go HTTP server (src/main.go) to receive and log incoming requests, and a test script (test/main.go) that reads a list of target servers from a JSON file and sends specially crafted HTTP requests to them. The exploit demonstrates the vulnerability by causing the target Apache server to forward requests to an attacker-controlled server, which can be used to verify the vulnerability and potentially spoof source IPs in DoS attacks. The code is written in Go and is structured for easy testing against multiple targets. No detection-only scripts or fake code are present; the repository is a functional POC exploit.