CVE-2024-38475 PoC — Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

Source

https://github.com/soltanali0/CVE-2024-38475

Associated Vulnerability

Title:Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)
Description:Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

Description

exploit CVE-2024-38475(mod_rewrite weakness with filesystem path matching)

Readme

# CVE-2024-38475
exploit CVE-2024-38475(mod_rewrite weakness with filesystem path matching)

This repository contains a Python script for testing web server vulnerabilities, specifically targeting Apache servers. The script checks for potential issues (mod_rewrite weakness with filesystem path matching) to exposed source code using wordlists for directories and files and applies various payloads.

Usage:
To run the script, use the following command:

```bash
python3 script.py --webroots webroots.txt --url 127.0.0.1 --schema http --directory_wordlist raft-medium-directories.txt --file_wordlist raft-medium-files.txt
```

Inspired by:

1. https://github.com/mrmtwoj/apache-vulnerability-testing
2. https://github.com/p0in7s/CVE-2024-38475

File Snapshot


 [4.0K]  /data/pocs/99420ea9090a557d9dcb3c20189948840c19d105
├── [ 744]  README.md
└── [2.4K]  script.py

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!