cbcvebase.
CVE-2006-3747
published 2006-07-28

CVE-2006-3747: Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2…

PriorityP267high7.6CVSS 2.0
AVNACHAuNCCICAC
EXPLOIT
EPSS
96.44%
99.9th percentile
Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.

Affected

9 ranges
VendorProductVersion rangeFixed in
apachehttp_server>= 1.3.28 < 1.3.371.3.37
apachehttp_server>= 2.0.46 < 2.0.592.0.59
apachehttp_server>= 2.2.0 < 2.2.32.2.3
apachehttpd
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debianapache2< apache2 2.0.55-4.1 (bookworm)apache2 2.0.55-4.1 (bookworm)
debiandebian_linux

Detection & IOCsextracted from sources · hover to see the quote

url/ldap://localhost/%3fA%3fA%3fCCCCCCCCCC%3fC%3f%90
url/ldap://localhost/%3fA%3fA%3fCCCCCCCCCC%3fC%3f%90
commandGET /kung/ldap://localhost/<NOP_SLED><SHELLCODE> HTTP/1.1
bytes
\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49\x48\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x41
  • Exploit requests contain 'ldap://' in the URI path sent to Apache mod_rewrite; look for HTTP GET requests with 'ldap://' in the URL path, especially combined with NOP sleds (%90) or encoded shellcode characters.
  • The exploit requires 'RewriteEngine on' and a specific RewriteRule to be configured on the target Apache server; detection should focus on HTTP requests with ldap:// scheme in the URI path routed through mod_rewrite.
  • Payload bad characters for this exploit are null byte, newline, carriage return, and space (\x00\x0a\x0d\x20); encoded payload uses AlphanumUpper encoding — look for long alphanumeric strings in the URI following the ldap:// trigger.
  • Vulnerable Apache versions are 1.3.29-36, 2.0.47-58, and 2.2.1-2; inventory and alert on these specific version strings in HTTP Server response headers.
  • ·Exploitation requires RewriteEngine to be enabled and a specific RewriteRule to be present in the Apache configuration; servers without mod_rewrite or without a matching RewriteRule are not exploitable.
  • ·The Metasploit module and public exploits currently only support Windows-based Apache installations; Linux exploitation may require different shellcode addresses and offsets.

CVSS provenance

nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
ghsa5.0MEDIUM
osv7.6HIGH
vendor_apache7.6HIGH
vendor_debian7.6MEDIUM
vendor_redhat7.6HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.