Apache 2.4.49 Path Traversal + Remote Code Execution (CVE-2021-41773)

Vulnerability Description

This vulnerability affects versions of Apache HTTP Server 2.4.49. A path validation error allows remote attackers to perform Path Traversal using sequences like .%2e/ to access paths outside the configured root directory.

When the mod_cgi module is enabled, an attacker can execute arbitrary commands by sending specially crafted requests to a CGI file. This allows remote code execution (RCE).

• CVE: CVE-2021-41773
• Severity: High
• Attack vector: Remote, unauthenticated
• Requirements: mod_cgi enabled

---

Exploit Usage

This script allows exploiting the vulnerability by sending remote commands to the affected server.

Dependencies