Listen to this Post
How the mentioned CVE works:
A flaw was introduced in Apache HTTP Server 2.4.49 with a change to the path normalization algorithm. The vulnerability, CVE-2021-41773, arises due to insufficient validation of the request URL. An attacker can craft a specially crafted request containing path traversal sequences, such as `%2e%2e/` (URL-encoded ‘../’). If the `require all denied` directive is not set for specific directories, the server fails to properly interpret these sequences and maps the request to a location outside the expected document root. This allows unauthorized access to arbitrary files on the filesystem. Furthermore, if CGI scripts are enabled, this path traversal can be leveraged to achieve remote code execution by sending a maliciously crafted request that targets an executable file, allowing the attacker to execute commands on the underlying server with the privileges of the web server process.
Platform: Apache HTTP Server
Version: 2.4.49
Vulnerability: Path Traversal
Severity: Critical
date: 2021-10-05
Prediction: Patch released 2021-10-07
What Undercode Say:
Analytics:
curl -v "http://target:80/cgi-bin/.%2e/%2e%2e/%2e%2e/etc/passwd" nmap -p 80 --script http-vuln-cve2021-41773 <target> cat /etc/apache2/sites-available/000-default.conf | grep -A5 -B5 "Require"
How Exploit:
An attacker sends an HTTP request with URL-encoded path traversal sequences to bypass security restrictions and access or execute files outside the web root.
Protection from this CVE:
Immediately upgrade to Apache HTTP Server version 2.4.50 or later. Ensure the configuration uses `Require all denied` for directories that should not be accessible.
Impact:
Unauthorized file disclosure and remote code execution on vulnerable servers, potentially leading to full system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
