CVE-2024-40725 PoC — Apache HTTP Server: source code disclosure with handlers configured via AddType

Source

Associated Vulnerability

Description

exploit CVE-2024-40725 (Apache httpd) with 

Readme

# HTTP Request Smuggling Detection Tool

This repository contains a Python-based tool to detect HTTP Request Smuggling vulnerabilities, specifically targeting `CVE-2024-40725`. The tool attempts to exploit this vulnerability in Apache HTTP Server by sending crafted HTTP requests and analyzing the server's responses. The primary goal is to identify discrepancies in status codes or access behavior, such as bypassing restrictions on specific paths.

## Features

- Detect HTTP Request Smuggling vulnerabilities.
- Supports single URL testing and batch testing using a list of URLs.
- Allows custom wordlists for testing various endpoint paths.
- Stores output results in a log file for further analysis.
- Identifies cases where status codes differ before and after smuggling attempts (e.g., `403` → `200`).

## Requirements

- Python 3.7+
- `requests` library

Install the required library using pip:

```bash
pip install requests
```

## Usage

### Single URL

Run the tool for a single URL:

```bash
python detect_http_smuggling.py -u https://example.com -w wordlist.txt -o output.log
```

### Batch URL Testing

Test multiple URLs from a file:

```bash
python detect_http_smuggling.py -l urls.txt -w wordlist.txt -o output.log
```

### Parameters

| Parameter | Description                              |
|-----------|------------------------------------------|
| `-u`      | Target URL for testing                  |
| `-l`      | File containing a list of target URLs   |
| `-w`      | Custom wordlist for endpoint fuzzing    |
| `-o`      | Output file for saving results          |

## Example Output

```text
Target: https://example.com
Status Change Detected:
  /admin 403 ---> /admin 200

Target: https://anotherexample.com
No vulnerability was detected.
```

## Credits

This tool was inspired by the work found in the following repository:

[https://github.com/TAM-K592/CVE-2024-40725-CVE-2024-40898/blob/ALOK/CVE-2024-40725.py#L21](https://github.com/TAM-K592/CVE-2024-40725-CVE-2024-40898/blob/ALOK/CVE-2024-40725.py#L21)

## Disclaimer

This tool is intended for educational purposes and authorized security testing only. Unauthorized use of this tool against systems you do not own or have explicit permission to test is illegal and unethical. Use responsibly.

File Snapshot

 [4.0K]  /data/pocs/de2d9f5a4aa70407f7cab3190fca89db082faa16
├── [4.9K]  detect_smuggling.py
└── [2.2K]  README.md

0 directories, 2 files

Remarks