Listen to this Post
How the mentioned CVE works:
CVE-2021-41773 is a critical path traversal vulnerability in Apache HTTP Server versions 2.4.49. A flaw exists in the normalization of file paths within the Apache core. When the `require all denied` directive is not used, the vulnerability can be exploited. An attacker can craft a specific URL containing encoded path traversal sequences, such as `%2e%2e/` (which decodes to ../). If the requested directory is aliased, this malformed request can bypass security checks. This allows the attacker to map URLs to files outside the expected document root, leading to unauthorized access to arbitrary files. If mod_cgi is enabled and a CGI script is present in the accessible directory, this flaw can be further exploited to achieve remote code execution on the server, as the attacker can force the server to execute the script with their own parameters.
Platform: Apache HTTP Server
Version: 2.4.49
Vulnerability: Path Traversal
Severity: Critical
date: 2021-10-05
Prediction: Patch released 2021-10-07
What Undercode Say:
`curl -H “Content-Length: 0” -X POST “http://target/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh” -d “echo; id”`
`nmap -p 80 –script http-vuln-cve2021-41773 `
`grep -r “require all denied” /etc/apache2/sites-enabled/`
How Exploit:
Craft a URL with encoded traversal sequences to access files outside the web root or execute commands if mod_cgi is active.
Protection from this CVE:
Immediately upgrade to Apache HTTP Server version 2.4.50 or later. Ensure all aliased directories are properly secured with the `require all denied` directive.
Impact:
Unauthorized file disclosure and remote code execution, potentially leading to full server compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
