CVE-2017-9798
HIGH EXPLOITED RANSOMWAREApache httpd <2.4.28 - Use After Free
Title source: llmExploitation Summary
CVE-2017-9798 has been observed exploited in the wild (reported by VulnCheck KEV), including in ransomware campaigns.
EIP tracks 8 public exploits from researchers including Hanno Bock, brokensound77, nitrado, including a Metasploit module auxiliary/scanner/http/apache_optionsbleed.
AI-analyzed exploit summary This script tests for the Optionsbleed vulnerability (CVE-2017-9798) by sending OPTIONS requests to a target host and analyzing the 'Allow' header for anomalies such as duplicates, spaces, or corrupted data. It supports multiple URL prefixes and repeated testing to detect inconsistencies.
Description
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
Exploits (8)
This script tests for the Optionsbleed vulnerability (CVE-2017-9798) by sending OPTIONS requests to a target host and analyzing the 'Allow' header for anomalies such as duplicates, spaces, or corrupted data. It supports multiple URL prefixes and repeated testing to detect inconsistencies.
This repository contains a scanner for CVE-2017-9798 (OptionsBleed), which exploits an information leak vulnerability in Apache HTTP Server. The scanner sends multiple HTTP OPTIONS and custom method requests to detect inconsistencies in the 'Allow' header responses.
This repository contains a Python script that scans for vulnerable .htaccess files affected by CVE-2017-9798. It checks for disallowed HTTP methods in <Limit> directives, which could lead to unauthorized access or privilege escalation.
This PoC scans for CVE-2017-9798 (OptionsBleed), a vulnerability in Apache HTTP Server where the 'Allow' header may leak arbitrary memory content. The script sends OPTIONS requests and parses the response for unexpected data in the 'Allow' header.
This repository contains a functional Perl script that exploits CVE-2017-9798 (OptionsBleed) in Apache HTTP Server by sending crafted OPTIONS requests to detect memory leakage in the Allow header. The script checks for irregular separators in the header to confirm vulnerability.
This repository contains a functional Perl script that exploits CVE-2017-9798 (OptionsBleed) in Apache HTTP Server by sending crafted OPTIONS requests to detect memory leaks in the Allow header. The script checks for irregular separators in the header to confirm vulnerability.
This repository contains a Python script that scans for vulnerable .htaccess files affected by CVE-2017-9798. It checks for disallowed HTTP methods within <Limit> directives, which could lead to unauthorized access or privilege escalation.
This Metasploit module scans for the Apache Optionsbleed vulnerability (CVE-2017-9798) by sending OPTIONS requests and analyzing the Allow header for memory leakage or other bugs. It checks for repeated or malformed method lists in the response.
References (56)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N