PoC Exploit Released for Critical WebDAV 0-Day RCE Vulnerability Exploited by APT Hackers

A critical zero-day vulnerability in WebDAV implementations that enables remote code execution, with proof-of-concept exploit code now publicly available on GitHub. 

The vulnerability, tracked as CVE-2025-33053, has reportedly been actively exploited by advanced persistent threat (APT) groups in targeted campaigns against enterprise networks. 

The exploit leverages malicious URL shortcut files combined with WebDAV server configurations to achieve initial access and lateral movement within compromised environments.

Critical WebDAV 0-Day RCE Vulnerability

Threat actors have been exploiting this WebDAV vulnerability as part of broader attack campaigns targeting organizations with publicly accessible WebDAV services. 

The attack methodology involves deploying malicious .url shortcut files that automatically establish connections to attacker-controlled WebDAV servers when executed by unsuspecting users. 

These campaigns have demonstrated particular effectiveness against environments running Apache2 with WebDAV modules enabled, where default configurations often lack adequate access controls.

The vulnerability stems from improper handling of URL shortcut files that contain UNC (Universal Naming Convention) paths pointing to remote WebDAV shares. 

When victims interact with these files, Windows systems automatically attempt to authenticate with the remote server, potentially exposing NTLM credentials or triggering the execution of malicious payloads. 

Security researchers have observed APT groups distributing these weaponized shortcuts through phishing campaigns, often disguised as legitimate business documents with names like “finance_report.url” or similar contextually relevant filenames.

Proof-of-Concept Released

Security researcher DevBuiHieu has published a comprehensive proof-of-concept repository demonstrating the vulnerability’s exploitation mechanisms. 

The toolkit includes automated scripts for establishing WebDAV infrastructure and generating malicious shortcut files. The primary setup script, setup_webdav.sh, automates the deployment of vulnerable WebDAV configurations:

The exploitation toolkit also features a Python-based payload generator (gen_url.py) that creates weaponized URL shortcut files with customizable parameters:

Advanced configuration options allow attackers to specify custom executables, icon files, and working directories within the malicious shortcuts. 

The generated .url files contain specially crafted InternetShortcut sections that reference remote WebDAV paths through UNC notation, triggering automatic connection attempts when opened. 

These files typically include parameters such as WorkingDirectory=\\192.168.1.100\webdav\ and customizable IconFile paths to enhance social engineering effectiveness.

The public release of this proof-of-concept significantly elevates the threat landscape for organizations utilizing WebDAV services. 

System administrators should immediately audit their Apache2 WebDAV configurations and implement restrictive access controls to prevent unauthorized connections. 

Critical mitigation steps include disabling unnecessary DAV and DAV_FS modules, implementing robust authentication mechanisms, and restricting WebDAV access to authenticated users only.

Organizations should also deploy email security solutions capable of detecting and quarantining malicious URL shortcut files, as traditional antivirus solutions may not reliably identify these attack vectors. 

Network monitoring should focus on identifying unusual UNC path connections and WebDAV traffic patterns that could indicate exploitation attempts. 

Group Policy configurations should be reviewed to restrict automatic network authentication and prevent unauthorized access to remote resources.

Live Credential Theft Attack Unmask & Instant Defense – Free Webinar

The post PoC Exploit Released for Critical WebDAV 0-Day RCE Vulnerability Exploited by APT Hackers appeared first on Cyber Security News.