Apache Httpd 2.4.18 — Exploit !!install!!

CVE-2016-5387, nicknamed "HTTPOXY," is a misnomer. It is not an Apache bug per se, but a design flaw in how CGI scripts handled the Proxy header. An attacker could send a request containing a Proxy: http://evil.com header, tricking server-side scripts (PHP, Python, Go) into routing outgoing HTTP requests through a malicious proxy.

7.5 (High) Type: Information Disclosure / Proxy Misconfiguration

git clone https://github.com/hannob/optionsbleed python3 optionsbleed.py http://victim apache httpd 2.4.18 exploit

: The attacker writes malicious data structures into the shared scoreboard memory space. They replace normal worker references with pointers targeting arbitrary code functions.

: An attacker with the ability to execute PHP or CGI scripts (low-privileged user www-data ) can escalate to root . Mechanism : CVE-2016-5387, nicknamed "HTTPOXY," is a misnomer

: Known as CARPE (Apache Root Privilege Escalation) , this affects Apache versions 2.4.17 through 2.4.38. A less-privileged child process (like one running a PHP script) could manipulate the shared memory scoreboard to execute code as the root user during a graceful restart ( apache2ctl graceful ).

The front-end proxy views the packet as a single request and passes it forward. Apache 2.4.18 misinterprets the whitespace, truncating the stream and reading the remaining data as a separate, second hidden request. Mechanism : : Known as CARPE (Apache Root

Apache uses a shared memory segment called the scoreboard to track the status of its various worker processes. In version 2.4.18, unprivileged child processes can read and write to this scoreboard structure.