burjoy/cve-2024-40275_scannerScanner for CVE-2024-40725 Apache HTTP Server source-code disclosure; probes direct and subrequest paths, fingerprints affected versions, and outputs JSON reports for CI/CD.
A Python-based detection tool for CVE-2024-40725, an Apache HTTP Server source code disclosure vulnerability affecting versions 2.4.0 and 2.4.61.
Legal notice: Only run this scanner against servers you own or have explicit written authorization to test. Unauthorized use may violate computer fraud laws (e.g., CFAA, Computer Misuse Act).
CVE-2024-40725 is a regression in Apache's internal request pipeline introduced in
version 2.4.0 (as an incomplete fix for CVE-2024-39884). When a server is configured
using legacy AddType directives (e.g., AddType application/x-httpd-php .php),
Apache's internal handler assignment is silently dropped during subrequest processing
(triggered by DirectoryIndex, mod_rewrite, or mod_dir).
As a result, the PHP script interpreter is never invoked. Instead, Apache's built-in
default-handler opens the file from disk and streams its raw bytes, including
database credentials, API keys, and application logic directly to the client.
Affected versions: Apache httpd 2.4.0 – 2.4.61
Fixed in: Apache httpd 2.4.62+
requests librarypip install requests
# Clone or download the scanner
curl -O https://your-host/cve_2024_40725_scanner.py
# Make executable (optional)
chmod +x cve_2024_40725_scanner.py
python3 cve_2024_40725_scanner.py --target <URL> [OPTIONS]
| Flag | Type | Default | Description |
|---|---|---|---|
--target | URL | (required) | Base URL of the Apache server to test |
--paths | PATH [PATH ...] | built-in list | One or more PHP paths to probe directly |
--wordlist | FILE | — | Path to a wordlist file (one path per line) |
--no-directory-check | flag | off | Skip subrequest/directory-index probe (Probe B) |
--timeout | int (seconds) | 10 | Per-request timeout |
--delay | float (seconds) | 0.0 | Delay between requests (rate limiting) |
--no-verify-ssl | flag | off | Disable SSL certificate verification |
--output | FILE | — | Write full JSON report to this file |
--verbose | flag | off | Enable debug output |
# Quickstart: scan localhost with built-in default paths
python3 cve_2024_40725_scanner.py --target http://localhost
# Scan specific paths
python3 cve_2024_40725_scanner.py \
--target http://192.168.1.10 \
--paths /index.php /admin/config.php /wp-config.php
# Use a wordlist file
python3 cve_2024_40725_scanner.py \
--target http://192.168.1.10 \
--wordlist php_paths.txt
# Combine wordlist + extra inline paths (merged, deduplicated)
python3 cve_2024_40725_scanner.py \
--target http://192.168.1.10 \
--wordlist php_paths.txt \
--paths /extra/secret.php
# HTTPS with self-signed certificate
python3 cve_2024_40725_scanner.py \
--target https://myserver.local \
--no-verify-ssl
# Polite scan with 1 second delay and JSON report
python3 cve_2024_40725_scanner.py \
--target http://myserver.local \
--wordlist php_paths.txt \
--delay 1.0 \
--output results.json \
--verbose
# CI/CD usage (exit code 1 = vulnerable, 0 = clean)
python3 cve_2024_40725_scanner.py --target http://localhost || echo "VULNERABLE"
One path per line. Lines starting with # are treated as comments and skipped.
Blank lines are ignored. Leading slashes are normalized automatically.
# Common PHP entrypoints
/index.php
/info.php
/phpinfo.php
# Admin panels
/admin/index.php
/admin/config.php
# CMS files
/wp-config.php
/wp-login.php
/configuration.php
# API internals
/api/v1/status.php
The scanner runs two probes per path:
GET /index.php HTTP/1.1
Checks whether requesting the PHP file directly returns its raw source code.
Affected in misconfigured servers where AddType is broken even for direct requests.
GET / HTTP/1.1
Requests the parent directory instead of the file itself. Apache internally
resolves DirectoryIndex → index.php, spawning a subrequest. This is the exact
code path where r->handler is dropped to NULL in Apache 2.4.0–2.4.61.
Probe B is the more important and realistic test. Many servers are only vulnerable through the subrequest path, not the direct file path.
The scanner checks the response body for PHP source code signatures:
<?php<?PHP<?=When a match is found, it extracts a 150-character snippet around the leak location for triage without printing the entire response body.
Reads the Server: response header to detect the Apache version. Flags servers
reporting version 2.4.0 or 2.4.61 even before a confirmed leak.
Note: Hardened servers may suppress the
Server:header (ServerTokens Prod). The scanner still runs all probes regardless.
============================================================
CVE-2024-40725 -- Apache Source Code Disclosure Scanner
============================================================
Target : http://localhost
Paths : 6
Time : 2024-08-01T12:00:00
[*] Fingerprinting server: http://localhost
Server Header : Apache/2.4.61 (Debian)
Apache Version: 2.4.61
[!] Version is in vulnerable range (2.4.0 - 2.4.61)
[*] Testing 6 path(s)...
--- /index.php
Direct (HTTP 200): OK
Subreq (HTTP 200): LEAKED
[!] VULNERABLE via: subrequest (directory index)
Leaked snippet: '<?php\n$db_pass = "supersecretpassword";'
--- /info.php
Direct (HTTP 404): OK
Subreq (HTTP 404): OK
[+] Safe
============================================================
SCAN SUMMARY
============================================================
Target : http://localhost
Apache Version : 2.4.61
Paths Tested : 6
Vulnerable Paths : 1
Safe Paths : 5
[!] RESULT: VULNERABLE
Vulnerable paths:
* /index.php (trigger: subrequest (directory index))
Remediation:
1. Upgrade to Apache httpd >= 2.4.62
2. Replace 'AddType' with 'SetHandler' in <FilesMatch> blocks
============================================================
--output results.json){
"target": "http://localhost",
"scan_time": "2024-08-01T12:00:00",
"apache_version": "2.4.61",
"apache_in_range": true,
"paths_tested": 6,
"vulnerable_paths": [
{
"path": "/index.php",
"direct_url": "http://localhost/index.php",
"directory_url": "http://localhost/",
"direct_status": 200,
"direct_leaked": false,
"direct_snippet": null,
"directory_status": 200,
"directory_leaked": true,
"directory_snippet": "<?php\n$db_pass = \"supersecretpassword\";",
"server_header": "Apache/2.4.61 (Debian)",
"vulnerable": true,
"trigger": "subrequest (directory index)"
}
],
"safe_paths": [...]
}
| Code | Meaning |
|---|---|
0 | No vulnerable paths detected |
1 | One or more vulnerable paths found |
Exit codes make the scanner suitable for use in CI/CD pipelines and automated infrastructure audits.
# Debian / Ubuntu
sudo apt update && sudo apt install apache2
# RHEL / CentOS / AlmaLinux
sudo dnf update httpd
# Verify version (must be >= 2.4.62)
apache2 -v
AddType with SetHandlerReplace any AddType directives used for PHP execution:
# ❌ Vulnerable Configs
AddType application/x-httpd-php .php
# ✅ Safe Configs
<FilesMatch "\.php$">
SetHandler "proxy:unix:/run/php/php8.2-fpm.sock|fcgi://localhost"
</FilesMatch>
# VULNERABLE
<VirtualHost *:80>
DocumentRoot /var/www/html
AddType application/x-httpd-php .php # ← triggers CVE
DirectoryIndex index.php
</VirtualHost>
# SAFE
<VirtualHost *:80>
DocumentRoot /var/www/html
<FilesMatch "\.php$">
SetHandler "proxy:unix:/run/php/php8.2-fpm.sock|fcgi://localhost"
</FilesMatch>
DirectoryIndex index.php
</VirtualHost>
| CVE | Version | Description |
|---|---|---|
| CVE-2024-39884 | 2.4.0 | Original source disclosure regression |
| CVE-2024-40725 | 2.4.61 | Incomplete fix — same class of bug |
| CVE-2024-40898 | 2.4.61 | Separate SSRF in mod_rewrite (Windows only) |