CVE-2019-0217

HIGH
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-0217 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC and 1 lab environment.

Description

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

Affected products and versions

1
ProductSourceVersion range

Apache HTTP Server

Browse Apache / Apache HTTP Server
CVE List2.4.0 to 2.4.38affected

Proofs of concept

1

Repository PoCs

GitHubsavsch/PoC_CVE-2019-0217Repository PoCby savsch0Not analyzed10 files

448.6 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

sample_vulnerable_server

savsch/PoC_CVE-2019-0217Created Vuln labCVE-2019-0217Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Dockerized Apache HTTP Server 2.4.38 with mod_auth_digest and a CGI script, intended as a proof-of-concept environment for CVE-2019-0217.

sample_vulnerable_server/Dockerfile:1-52README.md:1-3

Lab assessment

Vulnerability lab

The README explicitly states the repository contains a proof of concept exploit for CVE-2019-0217 and a Dockerfile to set up a vulnerable web server. The Dockerfile builds Apache 2.4.38 with mod_auth_digest and a CGI script, matching the described vulnerability.

README.md:1-3sample_vulnerable_server/Dockerfile:1-52
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Apache HTTP Server 2.4.38

vulnerable target

Built from source with mod_auth_digest and mod_cgi enabled. Configured to protect /scripts/userprofile.cgi with Digest authentication using a password file containing two users: victim and attacker.

sample_vulnerable_server/Dockerfile:7-12sample_vulnerable_server/Dockerfile:18-35

userprofile.cgi

protected resourceexploit target

A CGI script that echoes the authenticated user and displays sensitive info if the user is 'victim'. It is the resource an attacker would try to access as 'victim' to demonstrate the vulnerability.

sample_vulnerable_server/userprofile.cgi:1-10

index.html

landing page

A static HTML page that links to the protected CGI script and identifies the environment as a POC for CVE-2019-0217.

sample_vulnerable_server/index.html:1-12

generate_turbo_intruder_script.py

exploit generator

Mentioned in the README as a script that generates Turbo Intruder payloads to exploit the race condition. Not included in the evidence packet.

README.md:40-48
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2019-0217

Supported by supplied evidence

The Dockerfile builds Apache HTTP Server 2.4.38, which is within the vulnerable version range (2.4.38 and prior) specified in the CVE description. The configuration enables mod_auth_digest and sets up a threaded server (default MPM on Linux), matching the conditions for the race condition vulnerability.

sample_vulnerable_server/Dockerfile:7-12README.md:5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the vulnerable server.README.md:36-39
  • Burp Suite Community Edition with Turbo Intruder extension must be installed to execute the exploit.README.md:50-52
  • The attacker must have valid credentials (username 'attacker', password 'known') and know the victim's username ('victim').README.md:30-32sample_vulnerable_server/Dockerfile:42-43

Evidence-described exercise path

  1. Build the Docker image from the sample_vulnerable_server directory.README.md:37-38
  2. Run the container, mapping host port 8038 to container port 80.README.md:39
  3. Configure and run generate_turbo_intruder_script.py to produce Turbo Intruder script and request files.README.md:40-48
  4. In Burp Suite, set the target to the vulnerable server, load the generated request, and send to Turbo Intruder.README.md:50-60
  5. Paste the generated Turbo Intruder script and start the attack to trigger the race condition.README.md:62-66
  6. Observe results; successful exploitation shows the victim's sensitive info.README.md:68-70
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile and README describe a self-contained lab environment. The exploit targets only the lab's own Apache server and CGI script. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior beyond the intended vulnerability demonstration.

sample_vulnerable_server/Dockerfile:1-52README.md:1-74
Review boundaries

What the analysis did not establish

  • The exploit generator script (generate_turbo_intruder_script.py) is not included in the evidence packet; its behavior cannot be assessed.
  • The Dockerfile uses bitnami/minideb:latest, which may change over time and affect reproducibility.
  • The README references images (.assets/) that are not included, so the exact GUI steps cannot be verified.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

Showing 12 of 56