Apache HTTP Server < 2.4.54 - Insufficient Verification of Data Authenticity via X-Forwarded-* Headers
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2022-31813. PoCs published by dodiorne, yiliufeng168.
AI-analyzed exploit summary This repository contains a black-box vulnerability scanner for CVE-2022-31813, a path traversal and access control bypass vulnerability in Apache HTTP Server ≤ 2.4.53 using mod_proxy and ProxyPassMatch. The tool tests multiple bypass vectors, captures screenshots, and logs results in a structured CSV report.
Description
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
Exploits (2)
This repository contains a black-box vulnerability scanner for CVE-2022-31813, a path traversal and access control bypass vulnerability in Apache HTTP Server ≤ 2.4.53 using mod_proxy and ProxyPassMatch. The tool tests multiple bypass vectors, captures screenshots, and logs results in a structured CSV report.
This repository contains a functional PoC for CVE-2022-31813, demonstrating an HTTP request smuggling vulnerability via hop-by-hop header manipulation. The exploit bypasses IP-based access controls by injecting malicious headers (X-Real-IP, Connection) to spoof trusted internal traffic.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H