cve/2021/CVE-2021-40438.md

### [CVE-2021-40438](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438)
![](https://img.shields.io/static/v1?label=Product&message=Apache%20HTTP%20Server&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=Apache%20HTTP%20Server%202.4%3C%3D%202.4.48%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%20Server%20Side%20Request%20Forgery%20(SSRF)&color=brighgreen)

### Description

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

### POC

#### Reference
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html

#### Github
- https://github.com/00xPh4ntom/EPSSeeker
- https://github.com/0day666/Vulnerability-verification
- https://github.com/20142995/Goby
- https://github.com/8ctorres/SIND-Practicas
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
- https://github.com/Awrrays/FrameVul
- https://github.com/BLACKHAT-SSG/MindMaps2
- https://github.com/BabyTeam1024/CVE-2021-40438
- https://github.com/CHYbeta/OddProxyDemo
- https://github.com/CLincat/vulcat
- https://github.com/EGI-Federation/SVG-advisories
- https://github.com/HimmelAward/Goby_POC
- https://github.com/HxDDD/CVE-PoC
- https://github.com/Kashkovsky/CVE-2021-40438
- https://github.com/Lazykakarot1/Learn-365
- https://github.com/LoSunny/vulnerability-testing
- https://github.com/NaInSec/CVE-PoC-in-GitHub
- https://github.com/Ostorlab/KEV
- https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
- https://github.com/PierreChrd/py-projet-tut
- https://github.com/PwnAwan/MindMaps2
- https://github.com/SYRTI/POC_to_review
- https://github.com/Threekiii/Awesome-POC
- https://github.com/Threekiii/Vulhub-Reproduce
- https://github.com/Totes5706/TotesHTB
- https://github.com/WhiteOwl-Pub/EPSSeeker
- https://github.com/WhooAmii/POC_to_review
- https://github.com/Z0fhack/Goby_POC
- https://github.com/Zero094/Vulnerability-verification
- https://github.com/ajread4/nessus_crosswalk
- https://github.com/bakery312/Vulhub-Reproduce
- https://github.com/bioly230/THM_Skynet
- https://github.com/ericmann/apache-cve-poc
- https://github.com/firatesatoglu/shodanSearch
- https://github.com/gassara-kys/CVE-2021-40438
- https://github.com/ginoah/My-CTF-Challenges
- https://github.com/harsh-bothra/learn365
- https://github.com/kasem545/vulnsearch
- https://github.com/litt1eb0yy/One-Liner-Scripts
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/pisut4152/Sigma-Rule-for-CVE-2021-40438-exploitation-attempt
- https://github.com/sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit
- https://github.com/sixpacksecurity/CVE-2021-40438
- https://github.com/soosmile/POC
- https://github.com/trhacknon/Pocingit
- https://github.com/vsh00t/BB-PoC
- https://github.com/xiaojiangxl/CVE-2021-40438
- https://github.com/zecool/cve