Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Apache Proxy Paradox CVE-2021-40438

labs.cognisys.group | vulnerability | CVE-2021-40438 | #cloud | #pentesting | #apache | #ssrf | #cve-2021-40438 | #mod-proxy | #cloud-credentials

Summary

A black-box engagement: an outdated Apache 2.4.43 exposed CVE-2021-40438 (mod_proxy SSRF via Unix domain sockets), which testers weaponized to reach internal services and harvest cloud credentials.
Published
Collected

original ↗

Related coverage

  1. When JavaScript Chunks Become Keyholes to the Cloud (labs.cognisys.group)
  2. Supabase Leaks, What We Found (labs.cognisys.group)
  3. Turning Email Template Injection into Remote Code Execution (labs.cognisys.group)
  4. An Interesting XSS-Bypassing WAF (labs.cognisys.group)
  5. Unauthorized RCE in VMware vCenter (swarm.ptsecurity.com)
  6. CVE-2025-27888: Server-Side Request Forgery via URL Parsing Confusion in Apache Druid Proxy Endpoint (xbow.com)

back