CVE-2024-38475_SonicBoom_Apache_URL_Traversal_PoC

Author: abrewer251

A proof-of-concept tool for testing CVE-2024-38475 ("SonicBoom") Apache URL traversal vulnerability. This script automates TLS negotiation, directory scanning, traversal verification, and payload fuzzing to identify unauthorized file access.

Description

This repository contains a Python script (poc.py) that:

1. Negotiates the highest supported TLS/SSL protocol with the target.
2. Verifies generic directory traversal behavior.
3. Scans a directory wordlist for 403-protected directories.
4. Confirms traversal vulnerability per-directory.
5. Fuzzes file paths using custom payloads to detect real leaks.
6. Logs results to a specified output file.

This PoC helps security researchers and pen-testers rapidly validate the SonicBoom URL traversal flaw in Apache servers.

Prerequisites

• Python: 3.6 or higher

• Dependencies:

  • requests

Install dependencies via pip:

pip install -r requirements.txt

Note: requirements.txt should contain:

root@kitploit:~

requests

Installation

1. Clone the repository:

git clone https://github.com/abrewer251/CVE-2024-38475_SonicBoom_Apache_URL_Traversal_PoC.git
cd CVE-2024-38475_SonicBoom_Apache_URL_Traversal_PoC

2. Make the script executable (optional):

chmod +x poc.py

Run autoCurl.py to find out if PUT is a method allowed by the endpoint before continuing

Usage of poc.py

python3 poc.py [OPTIONS]

Required Argument

• --schema   Protocol to use (http or https)
• --host       Target host or IP
• --port       Target port
• --directory-wordlist  Path to directory wordlist file
• --file-wordlist    Path to file wordlist file
• --output       Path to write results to

Optional Flags

Examples

python3 poc.py \
  --schema https \
  --host 192.0.2.10 \
  --port 8443 \
  --directory-wordlist dirs.txt \
  --file-wordlist files.txt \
  --payloads "%2e%2e/" "%2e%2e%5C" \
  --output findings.log

Output Details

The output file contains a line-by-line log of each test stage:

• **[1/6] Negotiating TLS version negotiated
• [TRAVERSAL OK] for successful generic traversal
• [403] entries for protected directories found
• [TRAVERSAL OK] <dir> for per-directory traversal verification
• [200] lines for actual file leaks discovered
• Final status line: Done. Results saved to <output>

Each log entry follows the format:

[Stage] Message or status

License

Released under the MIT License. See LICENSE for details.