## https://sploitus.com/exploit?id=7FA1CEA0-5F33-5E7A-957E-3796BEE81843
# CVE-2024-40725 Scanner
A Python-based detection tool for **CVE-2024-40725**, an Apache HTTP Server source code
disclosure vulnerability affecting versions **2.4.0 and 2.4.61**.
> **Legal notice:** Only run this scanner against servers you own or have explicit
> written authorization to test. Unauthorized use may violate computer fraud laws
> (e.g., CFAA, Computer Misuse Act).
---
## Background
CVE-2024-40725 is a regression in Apache's internal request pipeline introduced in
version 2.4.0 (as an incomplete fix for CVE-2024-39884). When a server is configured
using legacy `AddType` directives (e.g., `AddType application/x-httpd-php .php`),
Apache's internal handler assignment is silently dropped during subrequest processing
(triggered by `DirectoryIndex`, `mod_rewrite`, or `mod_dir`).
As a result, the PHP script interpreter is never invoked. Instead, Apache's built-in
`default-handler` opens the file from disk and streams its raw bytes, including
database credentials, API keys, and application logic directly to the client.
**Affected versions:** Apache httpd 2.4.0 – 2.4.61
**Fixed in:** Apache httpd 2.4.62+
---
## Requirements
- Python 3.8+
- `requests` library
```bash
pip install requests
```
---
## Installation
```bash
# Clone or download the scanner
curl -O https://your-host/cve_2024_40725_scanner.py
# Make executable (optional)
chmod +x cve_2024_40725_scanner.py
```
---
## Usage
```
python3 cve_2024_40725_scanner.py --target [OPTIONS]
```
### Options
| Flag | Type | Default | Description |
|:--|:--|:--|:--|
| `--target` | URL | *(required)* | Base URL of the Apache server to test |
| `--paths` | PATH [PATH ...] | built-in list | One or more PHP paths to probe directly |
| `--wordlist` | FILE | — | Path to a wordlist file (one path per line) |
| `--no-directory-check` | flag | off | Skip subrequest/directory-index probe (Probe B) |
| `--timeout` | int (seconds) | `10` | Per-request timeout |
| `--delay` | float (seconds) | `0.0` | Delay between requests (rate limiting) |
| `--no-verify-ssl` | flag | off | Disable SSL certificate verification |
| `--output` | FILE | — | Write full JSON report to this file |
| `--verbose` | flag | off | Enable debug output |
---
## Examples
```bash
# Quickstart: scan localhost with built-in default paths
python3 cve_2024_40725_scanner.py --target http://localhost
# Scan specific paths
python3 cve_2024_40725_scanner.py \
--target http://192.168.1.10 \
--paths /index.php /admin/config.php /wp-config.php
# Use a wordlist file
python3 cve_2024_40725_scanner.py \
--target http://192.168.1.10 \
--wordlist php_paths.txt
# Combine wordlist + extra inline paths (merged, deduplicated)
python3 cve_2024_40725_scanner.py \
--target http://192.168.1.10 \
--wordlist php_paths.txt \
--paths /extra/secret.php
# HTTPS with self-signed certificate
python3 cve_2024_40725_scanner.py \
--target https://myserver.local \
--no-verify-ssl
# Polite scan with 1 second delay and JSON report
python3 cve_2024_40725_scanner.py \
--target http://myserver.local \
--wordlist php_paths.txt \
--delay 1.0 \
--output results.json \
--verbose
# CI/CD usage (exit code 1 = vulnerable, 0 = clean)
python3 cve_2024_40725_scanner.py --target http://localhost || echo "VULNERABLE"
```
---
## Wordlist Format
One path per line. Lines starting with `#` are treated as comments and skipped.
Blank lines are ignored. Leading slashes are normalized automatically.
```text
# Common PHP entrypoints
/index.php
/info.php
/phpinfo.php
# Admin panels
/admin/index.php
/admin/config.php
# CMS files
/wp-config.php
/wp-login.php
/configuration.php
# API internals
/api/v1/status.php
```
---
## How It Works
The scanner runs two probes per path:
### Probe A — Direct File Request
```
GET /index.php HTTP/1.1
```
Checks whether requesting the PHP file directly returns its raw source code.
Affected in misconfigured servers where `AddType` is broken even for direct requests.
### Probe B — Subrequest Trigger (the actual CVE path)
```
GET / HTTP/1.1
```
Requests the **parent directory** instead of the file itself. Apache internally
resolves `DirectoryIndex → index.php`, spawning a subrequest. This is the exact
code path where `r->handler` is dropped to `NULL` in Apache 2.4.0–2.4.61.
> Probe B is the more important and realistic test. Many servers are only vulnerable
> through the subrequest path, not the direct file path.
### Leak Detection
The scanner checks the response body for PHP source code signatures:
- ` Note: Hardened servers may suppress the `Server:` header (`ServerTokens Prod`).
> The scanner still runs all probes regardless.
---
## Output
### Terminal output example
```
============================================================
CVE-2024-40725 -- Apache Source Code Disclosure Scanner
============================================================
Target : http://localhost
Paths : 6
Time : 2024-08-01T12:00:00
[*] Fingerprinting server: http://localhost
Server Header : Apache/2.4.61 (Debian)
Apache Version: 2.4.61
[!] Version is in vulnerable range (2.4.0 - 2.4.61)
[*] Testing 6 path(s)...
--- /index.php
Direct (HTTP 200): OK
Subreq (HTTP 200): LEAKED
[!] VULNERABLE via: subrequest (directory index)
Leaked snippet: '= 2.4.62
2. Replace 'AddType' with 'SetHandler' in blocks
============================================================
```
### JSON report structure (`--output results.json`)
```json
{
"target": "http://localhost",
"scan_time": "2024-08-01T12:00:00",
"apache_version": "2.4.61",
"apache_in_range": true,
"paths_tested": 6,
"vulnerable_paths": [
{
"path": "/index.php",
"direct_url": "http://localhost/index.php",
"directory_url": "http://localhost/",
"direct_status": 200,
"direct_leaked": false,
"direct_snippet": null,
"directory_status": 200,
"directory_leaked": true,
"directory_snippet": "= 2.4.62)
apache2 -v
```
### Option 2: Replace `AddType` with `SetHandler`
Replace any `AddType` directives used for PHP execution:
```apache
# ❌ Vulnerable Configs
AddType application/x-httpd-php .php
# ✅ Safe Configs
SetHandler "proxy:unix:/run/php/php8.2-fpm.sock|fcgi://localhost"
```
---
## Vulnerable vs. Safe Configuration Reference
```apache
# VULNERABLE
DocumentRoot /var/www/html
AddType application/x-httpd-php .php # ← triggers CVE
DirectoryIndex index.php
# SAFE
DocumentRoot /var/www/html
SetHandler "proxy:unix:/run/php/php8.2-fpm.sock|fcgi://localhost"
DirectoryIndex index.php
```
---
## Related CVEs
| CVE | Version | Description |
|:--|:--|:--|
| CVE-2024-39884 | 2.4.0 | Original source disclosure regression |
| CVE-2024-40725 | 2.4.61 | Incomplete fix — same class of bug |
| CVE-2024-40898 | 2.4.61 | Separate SSRF in `mod_rewrite` (Windows only) |