Description
HTTP Protocol Stack Remote Code Execution Vulnerability
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Windows 10 Version 2004 | 10.0.0 – < 10.0.19041.982 | 10.0.19041.982 |
| Microsoft | Windows Server version 2004 | 10.0.0 – < 10.0.19041.982 | 10.0.19041.982 |
| Microsoft | Windows 10 Version 20H2 | 10.0.0 – < 10.0.19042.982 | 10.0.19042.982 |
| Microsoft | Windows Server version 20H2 | 10.0.0 – < 10.0.19042.982 | 10.0.19042.982 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Windows IIS HTTP Protocol Stack DOS
auxiliary/dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166
GitHub 12 repositories · most starred shown
-
0vercl0k/CVE-2021-31166 ★ 822 · May 16, 2021
Proof of concept for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely.
-
ZZ-SOCMAP/CVE-2021-31166 ★ 19 · Sep 27, 2021
Windows HTTP协议栈远程代码执行漏洞 CVE-2021-31166
-
corelight/CVE-2021-31166 ★ 12 · May 17, 2021
HTTP Protocol Stack CVE-2021-31166
-
0xmaximus/Home-Demolisher ★ 8 · Nov 22, 2022
PoC for CVE-2021-31166 and CVE-2022-21907
-
zha0gongz1/CVE-2021-31166 ★ 8 · May 17, 2021
PoC for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely. Although it was defined as remote command execution, it can only cause the system to crash.
-
y0g3sh-99/CVE-2021-31166-Exploit ★ 7 · Jul 3, 2021
Exploit for MS Http Protocol Stack RCE vulnerability (CVE-2021-31166)
-
mauricelambert/CVE-2021-31166 ★ 6 · Mar 7, 2022
CVE-2021-31166: exploitation with Powershell, Python, Ruby, NMAP and Metasploit.
-
zecopro/CVE-2021-31166 ★ 5 · May 19, 2021
simple bash script for exploit CVE-2021-31166
-
mvlnetdev/CVE-2021-31166-detection-rules ★ 3 · May 17, 2021
Different rules to detect if CVE-2021-31166 is being exploited
-
iranzai/CVE-2021-31166-exploit ★ 2 · Oct 20, 2021
Just a simple CVE-2021-31166 exploit tool
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.