## https://sploitus.com/exploit?id=70B2CC77-4D8A-556F-AB92-165EC41649DC
# CVE Analysis, Exploitation & Mitigation
A hands-on cybersecurity project focused on the vulnerability assessment, controlled exploitation, detection, mitigation, and validation of three publicly known vulnerabilities.
All testing was conducted in an isolated laboratory environment for educational and security assessment purposes.
## Project Overview
This project analyzes three CVEs affecting different web server and application technologies:
- **CVE-2021-41773** — Apache HTTP Server Path Traversal leading to Remote Code Execution
- **CVE-2019-11043** — PHP-FPM Remote Code Execution through a vulnerable Nginx/PHP-FPM configuration
- **CVE-2020-9484** — Apache Tomcat Session Deserialization leading to Remote Code Execution
For each vulnerability, the project followed a complete security assessment lifecycle:
1. Vulnerability identification
2. Laboratory setup and configuration
3. Controlled exploitation
4. Log and security event analysis
5. Detection
6. Mitigation and configuration hardening
7. Post-mitigation validation
## Laboratory Environment
The assessment was performed in an isolated virtual laboratory using:
- VirtualBox
- Kali Linux
- Ubuntu Server
- Apache HTTP Server
- Nginx
- PHP-FPM
- Apache Tomcat
- Docker
- Splunk Cloud
The environment was designed to keep testing separated from production or external systems.
## Vulnerabilities
### 1. CVE-2021-41773 — Apache HTTP Server
**Affected component:** Apache HTTP Server 2.4.49
The vulnerability allows path traversal through a vulnerable Apache configuration and can lead to unauthorized file access and Remote Code Execution when CGI is enabled.
The assessment covered:
- Vulnerable Apache deployment
- Path traversal testing
- Remote Code Execution
- Log analysis
- Attack detection
- Apache configuration hardening
- Post-mitigation validation
---
### 2. CVE-2019-11043 — PHP-FPM
**Affected component:** PHP-FPM with Nginx
This vulnerability was reproduced in a controlled Nginx/PHP-FPM laboratory environment.
The assessment covered:
- Vulnerable Nginx/PHP-FPM configuration
- Controlled exploitation
- Remote Code Execution
- Splunk Cloud log collection
- Detection of malicious activity
- Nginx configuration hardening
- Re-testing after mitigation
The vulnerable configuration was modified to remove the conditions required for exploitation, followed by validation that the exploit was no longer successful.
---
### 3. CVE-2020-9484 — Apache Tomcat
**Affected component:** Apache Tomcat versions prior to 9.0.35 under specific configuration conditions
This vulnerability involves insecure deserialization of session files when persistent session storage is configured in a vulnerable manner.
The assessment covered:
- Vulnerable Tomcat configuration
- Session-based exploitation
- Remote Code Execution
- Security event detection
- Splunk SIEM monitoring
- Configuration hardening
- Post-mitigation verification
## Detection & SIEM
Splunk Cloud was used as part of the security monitoring workflow.
The project included:
- Log collection
- Security event analysis
- Identification of malicious request patterns
- Detection of exploitation attempts
- Custom alerting
- Post-mitigation verification
For the PHP-FPM assessment, Splunk Cloud successfully captured exploitation-related logs and was used to verify the absence of exploitation events after mitigation.
## Mitigation Approach
Each vulnerability was followed by a remediation phase rather than stopping after successful exploitation.
The mitigation process included:
- Removing vulnerable configurations
- Hardening affected services
- Updating vulnerable configuration parameters
- Re-testing exploitation attempts
- Reviewing security logs after remediation
- Confirming that the original attack path was no longer viable
## Skills Demonstrated
- Vulnerability Assessment
- CVE Analysis
- Web Application Security
- Controlled Exploitation
- Remote Code Execution Analysis
- Linux Administration
- Apache Security
- Nginx Security
- PHP-FPM
- Apache Tomcat
- SIEM Monitoring
- Splunk Cloud
- Log Analysis
- Security Detection
- Mitigation & Hardening
- Security Validation
- Virtualized Laboratory Design
## Project Outcome
The project demonstrated the complete lifecycle of vulnerability assessment:
**Identify → Reproduce → Exploit → Detect → Mitigate → Validate**
The three vulnerabilities were successfully reproduced in the controlled laboratory environment, analyzed from both offensive and defensive perspectives, and followed by mitigation and validation.
## Disclaimer
This project was conducted strictly within an isolated laboratory environment for educational and cybersecurity training purposes. No unauthorized systems or third-party infrastructure were targeted.