Listen to this Post
How the mentioned CVE works:
CVE-2021-41773 is a critical path traversal vulnerability in Apache HTTP Server versions 2.4.49. A flaw exists in the normalization of URLs within the `ap_normalize_path()` function. When the server is configured with Require all granted, a misconfigured alias directive can allow an attacker to bypass security constraints. Specifically, a crafted request containing URL-encoded path traversal sequences (e.g., `.%2e/` or %2e%2e/) is not properly decoded and normalized before path validation. This allows an attacker to map URLs to files outside the expected document root. If the directory outside the root lacks the usual default configuration, the request may be executed by the server’s core module, potentially leading to remote code execution by serving CGI scripts that were not intended to be accessible.
DailyCVE Form:
Platform: Apache HTTP Server
Version: 2.4.49
Vulnerability: Path Traversal
Severity: Critical
date: 2021-10-05
Prediction: 2021-10-07
What Undercode Say:
Check server version httpd -v Example curl request attempting path traversal curl -v "http://target.com/cgi-bin/.%2e/%2e%2e/%2e%2e/etc/passwd" Search for vulnerable configurations in httpd.conf grep -E "Require.all.granted|Options.Indexes" /etc/httpd/conf/httpd.conf
How Exploit:
An attacker sends an HTTP request with a URL containing a payload like /icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd. If the server is misconfigured, this request bypasses the path normalization checks, allowing the attacker to read sensitive files from the filesystem. If CGI scripts are enabled in an aliased directory, the attacker can achieve remote code execution by requesting a script outside the document root.
Protection from this CVE:
Immediately upgrade to Apache HTTP Server version 2.4.50 or later. If an immediate upgrade is not possible, review and modify all `
Impact:
This vulnerability allows an unauthenticated remote attacker to access arbitrary files on the server’s filesystem, potentially leading to the disclosure of sensitive information such as passwords and configuration files. Under specific configurations where CGI scripts are enabled, it can lead to full remote code execution, compromising the entire server.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
