CVE-2001-0925
Apache HTTP Server - Directory Listing via Excessive Slash Characters
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2001-0925. PoCs published by st0ic, farm9, rfp.
AI-analyzed exploit summary This C program exploits CVE-2001-0925 by sending a crafted HTTP request with an artificially long path of slashes to an Apache server, causing directory indexing to be revealed even when an index.html file is present. It tests a range of slash counts to determine vulnerability.
Description
The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.
Exploits (4)
This C program exploits CVE-2001-0925 by sending a crafted HTTP request with an artificially long path of slashes to an Apache server, causing directory indexing to be revealed even when an index.html file is present. It tests a range of slash counts to determine vulnerability.
This exploit targets a vulnerability in Apache HTTPD (CVE-2001-0925) by sending a crafted HTTP request with an artificially long path of slashes to bypass directory indexing restrictions. It leverages a flaw in `ap_sub_req_lookup_file` where `stat()` fails on overly long paths, potentially exposing directory contents.
This exploit targets a vulnerability in Apache HTTPD (CVE-2001-0925) by sending a request with an artificially long path of slashes to trigger a directory listing, bypassing the default index.html. It leverages a flaw in the ap_sub_req_lookup_file subroutine where stat() fails on overly long paths.
This exploit targets a directory traversal vulnerability in Apache HTTPD versions prior to 1.3.19 by sending a request with an artificially long path of slashes. It uses the libwhisker library to craft HTTP requests and checks for a directory listing response.