CVE-2011-3368

Apache HTTP Server 1.3.x-1.3.42, 2.0.x-2.0.64, 2.2.x-2.2.21 SSRF via Malformed URI with @

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2011-3368. PoCs published by Rodrigo Marcos, SECFORCE, colorblindpentester, including Metasploit module auxiliary/scanner/http/rewrite_proxy_bypass.

AI-analyzed exploit summary This exploit leverages CVE-2011-3368, an SSRF vulnerability in Apache HTTP Server, to scan internal ports or retrieve resources from internal hosts by crafting malicious HTTP requests with the '@' character to bypass access controls.

Description

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

Exploits (4)

exploitdb WORKING POC VERIFIED
by Rodrigo Marcos · pythonremotemultiple
https://www.exploit-db.com/exploits/17969

This exploit leverages CVE-2011-3368, an SSRF vulnerability in Apache HTTP Server, to scan internal ports or retrieve resources from internal hosts by crafting malicious HTTP requests with the '@' character to bypass access controls.

Classification
Working Poc 95%
Attack Type
Ssrf
Complexity
Moderate
Reliability
Reliable
Target: Apache HTTP Server (versions affected by CVE-2011-3368)
No auth needed
Prerequisites: Network access to the vulnerable Apache server · Apache server configured to allow proxy requests or misconfigured access controls
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by SECFORCE · poc
https://github.com/SECFORCE/CVE-2011-3368

This PoC exploits CVE-2011-3368, an SSRF vulnerability in Apache HTTP Server, allowing an attacker to scan internal ports or retrieve resources from internal hosts via crafted HTTP requests. The script sends requests with a malformed URL to bypass access controls and probe internal services.

Classification
Working Poc 95%
Attack Type
Ssrf
Complexity
Trivial
Reliability
Reliable
Target: Apache HTTP Server (versions affected by CVE-2011-3368)
No auth needed
Prerequisites: Network access to the vulnerable Apache server · Apache server configured to allow the malformed URL syntax
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by colorblindpentester · poc
https://github.com/colorblindpentester/CVE-2011-3368

This PoC exploits CVE-2011-3368, an HTTP reverse proxy vulnerability in Apache HTTP Server, allowing internal port scanning and resource retrieval via crafted HTTP requests. It sends requests to an Apache server to probe internal hosts and ports, leveraging the vulnerability to bypass access controls.

Classification
Working Poc 95%
Attack Type
Ssrf
Complexity
Trivial
Reliability
Reliable
Target: Apache HTTP Server (versions affected by CVE-2011-3368)
No auth needed
Prerequisites: Access to a vulnerable Apache HTTP Server instance · Network connectivity to the target server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
by chao-mu · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/rewrite_proxy_bypass.rb

This Metasploit module scans for poorly configured Apache reverse proxy servers by attempting to bypass rewrite rules using an escape sequence and injected URI. It checks for vulnerability by comparing baseline and test status codes, flagging a 502 response as a potential bypass.

Classification
Scanner 100%
Attack Type
Ssrf
Complexity
Trivial
Reliability
Reliable
Target: Apache with mod_rewrite
No auth needed
Prerequisites: Access to the target server's HTTP/HTTPS service
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (55)

Core 55
Core References
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2012-0543.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2012-0542.html
Exploit, Patch mailing-list x_refsource_mlist
http://web.archiveorange.com/archive/v/ZyS0hzECD5zzb2NkvQlt
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=134987041210674&w=2
Mailing List mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2011/Oct/273
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-1391.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/46288
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/76079
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/17969
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=133294460209056&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/49957
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT5501
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/70336
Exploit, Patch x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=740045
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1026144
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-1392.html
Mailing List mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2011/Oct/232
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2011:144
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/46414
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/48551
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2012/dsa-2405
Vendor Advisory x_refsource_confirm
http://kb.juniper.net/JSA10585

Scores

EPSS 0.7254
EPSS Percentile 98.8%

Details

CWE
CWE-20
Status published
Products (49)
apache/http_server 1.3
apache/http_server 1.3.0
apache/http_server 1.3.1
apache/http_server 1.3.1.1
apache/http_server 1.3.2
apache/http_server 1.3.3
apache/http_server 1.3.4
apache/http_server 1.3.5
apache/http_server 1.3.6
apache/http_server 1.3.7
... and 39 more
Published Oct 05, 2011
Tracked Since Feb 18, 2026