Apache httpd <=2.4.29 - Arbitrary File Upload
Title source: nucleiExploitation Summary
CVE-2017-15715 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 2 public exploits from researchers including ehsehs5652, whisp1830. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository demonstrates CVE-2017-15715, an Apache HTTPD vulnerability where a crafted filename with a newline character can bypass `.php` extension restrictions in upload mechanisms, leading to arbitrary file upload and remote code execution. The PoC includes a Dockerized environment with a vulnerable PHP upload script and Apache configuration.
Description
In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.
Exploits (2)
This repository demonstrates CVE-2017-15715, an Apache HTTPD vulnerability where a crafted filename with a newline character can bypass `.php` extension restrictions in upload mechanisms, leading to arbitrary file upload and remote code execution. The PoC includes a Dockerized environment with a vulnerable PHP upload script and Apache configuration.
The repository contains only a README.md with a Docker image reference, lacking any exploit code or technical details. It appears to be a placeholder or incomplete submission.
Nuclei Templates (1)
cpe:"cpe:2.3:a:apache:http_server" || apache 2.4.49
References (27)
Scores
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H