WikiEducationFoundation / WikiEduDashboard

Wiki Education Foundation's Wikipedia course dashboard system
https://dashboard.wikiedu.org
MIT License
392 stars 630 forks source link

Apache HTTP Server need to be updated to be safe from malicious attack on the server #5314

Closed aniketsh22 closed 11 months ago

aniketsh22 commented 1 year ago

What is happening?

While doing recon I came across an IP address 45.79.140.16 which is the IP address of https://wikiedu.org/

image

After scanning it on https://www.shodan.io/ Founded that it has some vulnerabilities attached with the apache server

image

After that i checked for the technologies used on the https://wikiedu.org/ via https://www.wappalyzer.com/ And here is the POC attached below

image

As you can see the Apache HTTP Server is having version 2.4.51

To Reproduce

  1. Visit on https://www.shodan.io/
  2. Paste the IP address given above in the search box.
  3. Next you will find the vulnerabilities along with the CVE's
  4. For more you can search the CVE's on Internet for more information.

Expected behavior

Can cause error or malicious attack on the server.

Screenshots

POC is been Attached already !!

How to fix

Update the Apache HTTP Server version to fix this issues.

prathamVaidya commented 11 months ago

Is there a need to work on this issue? I couldn't locate the Apache setup in the Dockerfile. Is it handled manually instead of being configured within the Dockerfile?

ragesoss commented 11 months ago

This is handled manually. I've just updated the Apache version.