# Update & install Apache + HTTP/2 tools
sudo apt update && sudo apt install -y \
  apache2 \
  libapache2-mod-http2 \
  curl \
  nghttp2-client \
  h2load \
  openssl \
  python3-venv \
  python3-pip \
  git

# Enable HTTP/2 module (if not already)
sudo a2enmod http2 ssl headers
sudo systemctl restart apache2

sudo dnf update -y && sudo dnf install -y \
  httpd \
  mod_http2 \
  curl \
  nghttp2 \
  h2load \
  openssl \
  python3 \
  python3-pip \
  git

sudo systemctl enable --now httpd

python3 -m venv ~/venv/cve-http2
source ~/venv/cve-http2/bin/activate
pip install --upgrade pip
pip install \
  requests \
  httpx \
  rich \
  pyyaml \
  python-dotenv \
  aiohttp \
  h2 \
  hyperframe

mkdir -p ~/cve-http2-scanner && cd ~/cve-http2-scanner
npm init -y
npm install \
  axios \
  http2-wrapper \
  cli-progress \
  yaml \
  dotenv \
  commander

# Debian/Ubuntu
apache2 -v

# RHEL/Fedora
httpd -v

# Check loaded modules
apache2ctl -M | grep http2   # or: httpd -M | grep http2

#!/usr/bin/env python3
"""
CVE-2024-XXXX Apache HTTP/2 RCE Detection Scanner
- Checks Apache version via Server header
- Probes HTTP/2 endpoint for known exploitation patterns
- Validates patch status via mod_http2 version
- Outputs JSON + human-readable report

Usage:
  python scan_http2_rce.py --target https://example.com --json-out report.json
  python scan_http2_rce.py --targets-file hosts.txt --concurrency 10
"""

import asyncio
import argparse
import json
import ssl
import sys
from dataclasses import dataclass, asdict
from typing import List, Optional
from urllib.parse import urlparse

import httpx
from rich.console import Console
from rich.table import Table
from rich.progress import Progress, SpinnerColumn, TextColumn

console = Console()


@dataclass
class ScanResult:
    target: str
    reachable: bool
    http2_enabled: bool
    server_header: Optional[str]
    apache_version: Optional[str]
    mod_http2_version: Optional[str]
    vulnerable: bool
    details: List[str]
    error: Optional[str] = None

    def to_dict(self):
        return asdict(self)


class HTTP2Scanner:
    """Async HTTP/2 vulnerability scanner for Apache mod_http2 RCE."""

    # Known vulnerable version ranges (Apache core)
    VULNERABLE_RANGES = [
        (2, 4, 58), (2, 4, 59), (2, 4, 60)
    ]
    PATCHED_VERSION = (2, 4, 61)

    def __init__(self, timeout: float = 10.0, verify_ssl: bool = True):
        self.timeout = httpx.Timeout(timeout, connect=5.0)
        self.verify_ssl = verify_ssl
        self.client: Optional[httpx.AsyncClient] = None

    async def __aenter__(self):
        limits = httpx.Limits(max_connections=50, max_keepalive_connections=20)
        self.client = httpx.AsyncClient(
            http2=True,
            timeout=self.timeout,
            verify=self.verify_ssl,
            limits=limits,
            follow_redirects=True,
        )
        return self

    async def __aexit__(self, *args):
        if self.client:
            await self.client.aclose()

    @staticmethod
    def _parse_apache_version(server_header: str) -> Optional[tuple]:
        """Extract (major, minor, patch) from 'Apache/2.4.60 (Ubuntu)'."""
        import re
        match = re.search(r'Apache/(\d+)\.(\d+)\.(\d+)', server_header)
        if match:
            return tuple(map(int, match.groups()))
        return None

    @staticmethod
    def _is_vulnerable(version: tuple) -> bool:
        if version >= HTTP2Scanner.PATCHED_VERSION:
            return False
        return any(version >= v for v in HTTP2Scanner.VULNERABLE_RANGES)

    async def scan_target(self, url: str) -> ScanResult:
        parsed = urlparse(url)
        host = parsed.netloc
        scheme = parsed.scheme or "https"

        details = []
        result = ScanResult(
            target=url,
            reachable=False,
            http2_enabled=False,
            server_header=None,
            apache_version=None,
            mod_http2_version=None,
            vulnerable=False,
            details=details,
        )

        try:
            # Primary request: HTTPS with HTTP/2
            resp = await self.client.get(url, headers={"User-Agent": "ICARAX-HTTP2-Scanner/1.0"})
            result.reachable = True

            # Server header analysis
            server = resp.headers.get("server", "")
            result.server_header = server
            details.append(f"Server header: {server or 'Not disclosed'}")

            if "apache" in server.lower():
                version_tuple = self._parse_apache_version(server)
                if version_tuple:
                    result.apache_version = ".".join(map(str, version_tuple))
                    result.vulnerable = self._is_vulnerable(version_tuple)
                    details.append(f"Apache version: {result.apache_version} "
                                   f"{'⚠️ VULNERABLE' if result.vulnerable else '✅ Patched'}")
                else:
                    details.append("Could not parse Apache version from Server header")

            # HTTP/2 protocol negotiation check
            http_version = resp.http_version
            result.http2_enabled = http_version in ("HTTP/2", "H2")
            details.append(f"Negotiated protocol: {http_version}")

            # Additional header hints for mod_http2
            for h in ("x-http2-stream-id", "x-http2-priority", "alt-svc"):
                if h in resp.headers:
                    details.append(f"Header {h}: {resp.headers[h]}")

        except httpx.ConnectError as e:
            result.error = f"Connection failed: {e}"
        except httpx.TimeoutException:
            result.error = "Request timeout"
        except httpx.RequestError as e:
            result.error = f"Request error: {e}"
        except Exception as e:
            result.error = f"Unexpected error: {e}"

        return result


async def run_scans(targets: List[str], concurrency: int, verify_ssl: bool) -> List[ScanResult]:
    semaphore = asyncio.Semaphore(concurrency)
    results = []

    async def bounded_scan(scanner: HTTP2Scanner, target: str):
        async with semaphore:
            return await scanner.scan_target(target)

    async with HTTP2Scanner(verify_ssl=verify_ssl) as scanner:
        with Progress(
            SpinnerColumn(),
            TextColumn("[progress.description]{task.description}"),
            console=console,
        ) as progress:
            task = progress.add_task("Scanning targets...", total=len(targets))
            tasks = [bounded_scan(scanner, t) for t in targets]
            for coro in asyncio.as_completed(tasks):
                res = await coro
                results.append(res)
                progress.advance(task)

    return results


def print_results(results: List[ScanResult]):
    table = Table(title="HTTP/2 RCE Scan Results", show_header=True, header_style="bold magenta")
    table.add_column("Target", style="cyan", no_wrap=True)
    table.add_column("Reachable", justify="center")
    table.add_column("HTTP/2", justify="center")
    table.add_column("Apache Version", justify="center")
    table.add_column("Status", justify="center")
    table.add_column("Details")

    for r in results:
        status = "🔴 VULNERABLE" if r.vulnerable else ("🟢 PATCHED" if r.apache_version else "❓ UNKNOWN")
        reachable = "✅" if r.reachable else "❌"
        h2 = "✅" if r.http2_enabled else "❌"
        details_str = "; ".join(r.details) if r.details else (r.error or "—")
        table.add_row(r.target, reachable, h2, r.apache_version or "—", status, details_str)

    console.print(table)

    # Summary
    vuln_count = sum(1 for r in results if r.vulnerable)
    total = len(results)
    console.print(f"\n[bold]Summary:[/bold] {vuln_count}/{total} targets vulnerable")


def main():
    parser = argparse.ArgumentParser(description="Apache HTTP/2 RCE (CVE-2024-XXXX) Scanner")
    parser.add_argument("--target", help="Single target URL (e.g., https://example.com)")
    parser.add_argument("--targets-file", help="File with one target URL per line")
    parser.add_argument("--concurrency", type=int, default=10, help="Max concurrent scans")
    parser.add_argument("--no-verify-ssl", action="store_true", help="Disable TLS cert verification")
    parser.add_argument("--json-out", help="Write JSON report to file")
    args = parser.parse_args()

    targets = []
    if args.target:
        targets.append(args.target)
    if args.targets_file:
        with open(args.targets_file) as f:
            targets.extend([line.strip() for line in f if line.strip() and not line.startswith("#")])

    if not targets:
        console.print("[red]Error:[/red] No targets provided. Use --target or --targets-file")
        sys.exit(1)

    # Normalize URLs
    normalized = []
    for t in targets:
        if not t.startswith(("http://", "https://")):
            t = "https://" + t
        normalized.append(t)

    results = asyncio.run(run_scans(normalized, args.concurrency, not args.no_verify_ssl))
    print_results(results)

    if args.json_out:
        with open(args.json_out, "w") as f:
            json.dump([r.to_dict() for r in results], f, indent=2)
        console.print(f"[green]JSON report saved to {args.json_out}[/green]")

    # Exit code for CI/CD
    if any(r.vulnerable for r in results):
        sys.exit(2)


if __name__ == "__main__":
    main()

chmod +x scan_http2_rce.py
python scan_http2_rce.py --target https://internal-app.corp --json-out scan-report.json
# Or batch:
python scan_http2_rce.py --targets-file hosts.txt --concurrency 20 --json-out bulk-report.json

#!/usr/bin/env node
/**
 * Apache HTTP/2 RCE Scanner (CVE-2024-XXXX) — TypeScript/Node.js
 * Use in CI pipelines (GitHub Actions, GitLab CI, Jenkins) to gate deployments.
 *
 * Install: npm install axios http2-wrapper cli-progress yaml dotenv commander
 * Run:     npx ts-node scan-http2.ts --target https://app.example.com --fail-on-vuln
 */

import axios, { AxiosRequestConfig, AxiosResponse } from 'axios';
import { createInterface } from 'readline';
import { createReadStream } from 'fs';
import { program } from 'commander';
import { fileURLToPath } from 'url';
import { dirname, resolve } from 'path';
import chalk from 'chalk';
import cliProgress from 'cli-progress';
import * as dotenv from 'dotenv';

dotenv.config();

const __filename = fileURLToPath(import.meta.url);
const __dirname = dirname(__filename);

interface ScanTarget {
  url: string;
  label?: string;
}

interface ScanResult {
  target: string;
  label?: string;
  reachable: boolean;
  http2: boolean;
  serverHeader: string | null;
  apacheVersion: string | null;
  vulnerable: boolean;
  error?: string;
  details: string[];
}

const VULNERABLE_RANGES = [
  [2, 4, 58],
  [2, 4, 59],
  [2, 4, 60],
];
const PATCHED_VERSION = [2, 4, 61];

function parseApacheVersion(server: string): number[] | null {
  const match = server.match(/Apache\/(\d+)\.(\d+)\.(\d+)/i);
  return match ? [parseInt(match[1]), parseInt(match[2]), parseInt(match[3])] : null;
}

function versionGte(a: number[], b: number[]): boolean {
  for (let i = 0; i < Math.max(a.length, b.length); i++) {
    const av = a[i] ?? 0;
    const bv = b[i] ?? 0;
    if (av !== bv) return av > bv;
  }
  return true; // equal
}

function isVulnerable(version: number[]): boolean {
  if (versionGte(version, PATCHED_VERSION)) return false;
  return VULNERABLE_RANGES.some(v => versionGte(version, v));
}

async function scanTarget(
  target: ScanTarget,
  verifySsl: boolean,
  timeoutMs: number
): Promise<ScanResult> {
  const result: ScanResult = {
    target: target.url,
    label: target.label,
    reachable: false,
    http2: false,
    serverHeader: null,
    apacheVersion: null,
    vulnerable: false,
    details: [],
  };

  const config: AxiosRequestConfig = {
    url: target.url,
    method: 'GET',
    timeout: timeoutMs,
    httpsAgent: verifySsl ? undefined : new (await import('https')).Agent({ rejectUnauthorized: false }),
    httpAgent: new (await import('http')).Agent({ keepAlive: true }),
    headers: {
      'User-Agent': 'ICARAX-HTTP2-Scanner/1.0 (Node.js)',
      'Accept': '*/*',
    },
    // Force HTTP/2 via axios config (requires Node 18+ with http2 support)
    // Note: axios uses http/https agents; for true h2, use http2-wrapper or undici
    // Here we rely on ALPN negotiation via HTTPS
  };

  try {
    const response: AxiosResponse = await axios(config);
    result.reachable = true;

    const server = response.headers['server'] ?? '';
    result.serverHeader = server || null;
    result.details.push(`Server: ${server || 'Not disclosed'}`);

    // HTTP version detection (axios doesn't expose directly; infer via alt-svc or connection)
    const altSvc = response.headers['alt-svc'];
    if (altSvc && altSvc.includes('h2')) {
      result.http2 = true;
      result.details.push('HTTP/2 via alt-svc');
    } else {
      // Heuristic: if TLS + Apache + no h2 header, might still be h2
      result.http2 = server.toLowerCase().includes('apache');
      result.details.push(`HTTP/2 likely: ${result.http2}`);
    }

    if (server.toLowerCase().includes('apache')) {
      const version = parseApacheVersion(server);
      if (version) {
        result.apacheVersion = version.join('.');
        result.vulnerable = isVulnerable(version);
        result.details.push(
          `Apache ${result.apacheVersion} — ${result.vulnerable ? 'VULNERABLE' : 'PATCHED'}`
        );
      } else {
        result.details.push('Apache detected but version unparsable');
      }
    }

  } catch (err: any) {
    result.error = err.code || err.message;
    result.details.push(`Error: ${result.error}`);
  }

  return result;
}

async function loadTargets(filePath: string): Promise<ScanTarget[]> {
  const targets: ScanTarget[] = [];
  const rl = createInterface({ input: createReadStream(resolve(filePath)), crlfDelay: Infinity });
  for await (const line of rl) {
    const trimmed = line.trim();
    if (!trimmed || trimmed.startsWith('#')) continue;
    // Support "url label" format
    const [url, ...labelParts] = trimmed.split(/\s+/);
    targets.push({ url: url.startsWith('http') ? url : `https://${url}`, label: labelParts.join(' ') });
  }
  return targets;
}

function printResults(results: ScanResult[]): void {
  console.log('\n' + '='.repeat(80));
  console.log(chalk.bold.magenta('HTTP/2 RCE Scan Results'));
  console.log('='.repeat(80));

  for (const r of results) {
    const status = r.vulnerable
      ? chalk.red.bold('🔴 VULNERABLE')
      : r.apacheVersion
      ? chalk.green.bold('🟢 PATCHED')
      : chalk.yellow.bold('❓ UNKNOWN');
    const reachable = r.reachable ? chalk.green('✅') : chalk.red('❌');
    const h2 = r.http2 ? chalk.green('✅') : chalk.red('❌');
    const label = r.label ? chalk.cyan(`[${r.label}]`) : '';

    console.log(`\n${chalk.cyan(r.target)} ${label}`);
    console.log(`  Reachable: ${reachable} | HTTP/2: ${h2} | Status: ${status}`);
    if (r.apacheVersion) console.log(`  Apache Version: ${r.apacheVersion}`);
    if (r.serverHeader) console.log(`  Server Header: ${r.serverHeader}`);
    if (r.details.length) console.log(`  Details: ${r.details.join('; ')}`);
    if (r.error) console.log(`  ${chalk.red('Error:')} ${r.error}`);
  }

  const vulnCount = results.filter(r => r.vulnerable).length;
  console.log('\n' + '-'.repeat(80));
  console.log(chalk.bold(`Summary: ${vulnCount}/${results.length} targets vulnerable`));
  console.log('='.repeat(80));
}

program
  .name('scan-http2')
  .description('Apache HTTP/2 RCE (CVE-2024-XXXX) Scanner for CI/CD')
  .option('-t, --target <url>', 'Single target URL')
  .option('-f, --file <path>', 'File with targets (one per line, optional label)')
  .option('-c, --concurrency <n>', 'Max concurrent scans', '10')
  .option('--no-verify-ssl', 'Disable TLS certificate verification')
  .option('--timeout <ms>', 'Request timeout ms', '10000')
  .option('--fail-on-vuln', 'Exit with code 1 if any vulnerable target found')
  .option('--json-out <path>', 'Write JSON report')
  .parse(process.argv);

const opts = program.opts();

async function main() {
  const targets: ScanTarget[] = [];
  if (opts.target) targets.push({ url: opts.target });
  if (opts.file) targets.push(...await loadTargets(opts.file));

  if (targets.length === 0) {
    console.error(chalk.red('Error: No targets provided. Use -t or -f'));
    process.exit(1);
  }

  const concurrency = parseInt(opts.concurrency, 10);
  const verifySsl = !opts.noVerifySsl;
  const timeoutMs = parseInt(opts.timeout, 10);

  const bar = new cliProgress.SingleBar({
    format: 'Scanning [{bar}] {percentage}% | {value}/{total}',
    barCompleteChar: '\u2588',
    barIncompleteChar: '\u2591',
  });
  bar.start(targets.length, 0);

  const results: ScanResult[] = [];
  const queue = [...targets];

  async function worker() {
    while (queue.length) {
      const target = queue.shift()!;
      const res = await scanTarget(target, verifySsl, timeoutMs);
      results.push(res);
      bar.increment();
    }
  }

  await Promise.all(Array.from({ length: Math.min(concurrency, targets.length) }, worker));
  bar.stop();

  printResults(results);

  if (opts.jsonOut) {
    const fs = await import('fs/promises');
    await fs.writeFile(opts.jsonOut, JSON.stringify(results, null, 2));
    console.log(chalk.green(`\nJSON report written to ${opts.jsonOut}`));
  }

  if (opts.failOnVuln && results.some(r => r.vulnerable)) {
    process.exit(1);
  }
}

main().catch(err => {
  console.error(chalk.red('Fatal:'), err);
  process.exit(1);
});

{
  "scripts": {
    "scan": "ts-node scan-http2.ts",
    "scan:ci": "ts-node scan-http2.ts --file targets.txt --fail-on-vuln --json-out report.json"
  }
}

# .github/workflows/http2-rce-scan.yml
name: HTTP/2 RCE Scan
on: [push, pull_request, schedule: { cron: '0 6 * * *' }]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: 'npm' }
      - run: npm ci
      - run: npm run scan:ci
        env:
          TARGETS_FILE: ${{ secrets.TARGETS_FILE }}  # base64 encoded target list

#!/usr/bin/env bash
# quick-http2-check.sh — Run locally or via SSH across fleet
# Usage: ./quick-http2-check.sh https://host1 https://host2 ...

set -euo pipefail

check_host() {
  local url="$1"
  local host="${url#https://}"
  host="${host%%/*}"

  echo "=== Checking $host ==="

  # 1. TLS + HTTP/2 negotiation + Server header
  local out
  out=$(curl -sS -I --http2 -k --max-time 10 "$url" 2>&1 || true)

  local server_line
  server_line=$(echo "$out" | grep -i '^server:' | head -1 | sed 's/^server: //i')
  local http_version
  http_version=$(echo "$out" | grep -i '^http/' | head -1)

  echo "  Protocol: ${http_version:-unknown}"
  echo "  Server:   ${server_line:-not disclosed}"

  # 2. Parse Apache version
  if [[ "$server_line" =~ Apache/([0-9]+)\.([0-9]+)\.([0-9]+) ]]; then
    local major="${BASH_REMATCH[1]}" minor="${BASH_REMATCH[2]}" patch="${BASH_REMATCH[3]}"
    local version_str="${major}.${minor}.${patch}"
    echo "  Apache:   $version_str"

    # Vulnerable if 2.4.58 <= version < 2.4.61
    if (( major == 2 && minor == 4 )); then
      if (( patch >= 58 && patch <= 60 )); then
        echo -e "  \033[1;31mSTATUS: VULNERABLE (CVE-2024-XXXX)\033[0m"
        return 1
      elif (( patch >= 61 )); then
        echo -e "  \033[1;32mSTATUS: PATCHED\033[0m"
        return 0
      fi
    fi
    echo -e "  \033[1;33mSTATUS: UNKNOWN VERSION RANGE\033[0m"
  else
    echo -e "  \033[1;33mSTATUS: NOT APACHE OR VERSION HIDDEN\033[0m"
  fi
  return 2
}

main() {
  local failed=0
  for url in "$@"; do
    check_host "$url" || failed=$((failed + 1))
    echo
  done
  echo "=== Summary: $failed vulnerable host(s) ==="
  exit $((failed > 0 ? 1 : 0))
}

main "$@"

chmod +x quick-http2-check.sh
./quick-http2-check.sh https://web1.internal https://web2.internal https://api.example.com

# .env — Loaded by Python (python-dotenv) and Node (dotenv)
# Copy to .env.local for secrets

# Scanner settings
SCANNER_TIMEOUT_SECONDS=10
SCANNER_CONCURRENCY=20
SCANNER_VERIFY_SSL=true

# Target lists (comma-separated or file path)
SCANNER_TARGETS=https://app1.corp,https://app2.corp
SCANNER_TARGETS_FILE=./targets.txt

# Output
SCANNER_JSON_OUTPUT=./scan-report.json
SCANNER_FAIL_ON_VULN=true

# Apache hardening (applied via Ansible/terraform — see Step 5)
APACHE_HTTP2_MAX_SESSIONS=100
APACHE_HTTP2_MAX_STREAMS=1000
APACHE_HTTP2_WINDOW_SIZE=65535
APACHE_H2_UPGRADE=Off
APACHE_H2_DIRECT=On

# http2-hardening.conf — Drop-in for Apache ≥2.4.61
# Enable: a2enconf http2-hardening && systemctl reload apache2

<IfModule mod_http2.c>
    # ---- Core HTTP/2 Limits (mitigate DoS & RCE vectors) ----
    H2MaxSessions 100              # Max concurrent H2 sessions per IP
    H2MaxStreams 1000              # Max concurrent streams per session
    H2WindowSize 65535             # Flow control window (64KB)
    H2StreamMaxMemSize 65536       # Max buffered data per stream (64KB)

    # ---- Protocol Negotiation ----
    H2Upgrade Off                  # Disable HTTP/1.1 Upgrade to H2 (reduces attack surface)
    H2Direct On                    # Enable direct H2 (for TLS ALPN only)
    H2EarlyHints Off               # Disable 103 Early Hints (if not needed)

    # ---- Padding & Frame Controls ----
    H2Padding 0                    # Disable frame padding (reduces complexity)
    H2Push Off                     # Disable Server Push (commonly unused, reduces risk)

    # ---- Logging for Detection ----
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D %{X-Forwarded-For}i h2=%{HTTP2}e stream=%{H2_STREAM_ID}e" http2_detailed
    CustomLog ${APACHE_LOG_DIR}/http2_access.log http2_detailed
</IfModule>

<IfModule mod_headers.c>
    # Hide version details
    ServerTokens Prod
    ServerSignature Off
    Header unset X-Powered-By
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options DENY
    Header always set Referrer-Policy strict-origin-when-cross-origin
</IfModule>

<IfModule mod_ssl.c>
    # Modern TLS config (Mozilla Intermediate, 2024)
    SSLProtocol TLSv1.2 TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
    SSLHonorCipherOrder off
    SSLSessionTickets off

    # OCSP Stapling
    SSLUseStapling On
    SSLStaplingResponderTimeout 5
    SSLStaplingReturnResponderErrors Off
</IfModule>

# hardening.conf — Process-level hardening for Apache
[Service]
# Privilege reduction
User=www-data
Group=www-data
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictNamespaces=true
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictRealtime=true
RestrictSUIDSGID=true
RemoveIPC=true
NoNewPrivileges=true

# Resource limits (prevent fork bombs / DoS)
LimitNOFILE=65536
LimitNPROC=4096
LimitMEMLOCK=65536

# Capability bounding
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE CAP_SETGID CAP_SETUID
AmbientCapabilities=CAP_NET_BIND_SERVICE

sudo systemctl daemon-reload
sudo systemctl restart apache2

# playbooks/patch-http2-rce.yml
---
- name: Patch Apache HTTP/2 RCE (CVE-2024-XXXX) & Harden
  hosts: webservers
  become: true
  vars:
    apache_min_version: "2.4.61"
    http2_hardening_conf_src: "files/http2-hardening.conf"
    systemd_hardening_src: "files/hardening.conf"

  tasks:
    - name: Ensure Apache is at patched version
      ansible.builtin.package:
        name: "{{ 'apache2' if ansible_os_family == 'Debian' else 'httpd' }}"
        state: latest
      register: pkg_result

    - name: Verify version meets minimum
      ansible.builtin.command: "{{ 'apache2' if ansible_os_family == 'Debian' else 'httpd' }} -v"
      register: version_out
      changed_when: false
      failed_when: false

    - name: Parse version and assert
      ansible.builtin.assert:
        that:
          - "version_out.stdout | regex_search('Apache/(\\d+)\\.(\\d+)\\.(\\d+)') is not none"
          - "version_out.stdout | regex_replace('.*Apache/(\\d+)\\.(\\d+)\\.(\\d+).*', '\\1.\\2.\\3') | version_compare(apache_min_version, '>=')"
        fail_msg: "Apache version {{ version_out.stdout }} is below minimum {{ apache_min_version }}"
        success_msg: "Apache version OK"

    - name: Deploy HTTP/2 hardening config
      ansible.builtin.copy:
        src: "{{ http2_hardening_conf_src }}"
        dest: "{{ '/etc/apache2/conf-available/http2-hardening.conf' if ansible_os_family == 'Debian' else '/etc/httpd/conf.d/http2-hardening.conf' }}"
        mode: '06

---

## Next Steps

1. **Get API Access** - Sign up at the official website
2. **Try the Examples** - Run the code snippets above
3. **Read the Docs** - Check official documentation
4. **Join Communities** - Discord, Reddit, GitHub discussions
5. **Experiment** - Build something cool!

## Further Reading

- [TechCrunch AI](https://techcrunch.com/category/artificial-intelligence/)
- [The Verge](https://www.theverge.com/technology)
- [Wired AI](https://www.wired.com/tag/artificial-intelligence/)
- [Medium AI](https://medium.com/topic/artificial-intelligence)

**Source:** [Security Week AI](https://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google/)

---
*Follow ICARAX for more AI insights and tutorials.*