Post

Apache HTTPd newline resolution vulnerability CVE-2017-15715

Posted Updated
By Rhy0z
1 min read
Apache HTTPd newline resolution vulnerability CVE-2017-15715

Apache HTTPd newline resolution vulnerability CVE-2017-15715

Vulnerability Description

Apache HTTPD is an HTTP server that can run PHP web pages through mod_php.

Vulnerability Impact

Apache HTTPd version 2.4.0~2.4.29

Network surveying and mapping

server="Apache/2.4.49" </a-checkbox>

Vulnerability reappears

Uploading malicious files directly will be blocked

img

img

Modify the following parameters

img

Response is 200, successfully bypassed

Visiting https://xxx.xxx.xxx.xxx:8080/evil.php successfully triggered the parsing vulnerability

img

This post is licensed under CC BY 4.0 by the author.