HTTP Apache Path Traversal NSE Script (CVE-2021-41773)

Description

This NSE script checks if an Apache HTTP Server is vulnerable to the Path Traversal vulnerability (CVE-2021-41773).
A vulnerable server allows attackers to access files they shouldn't, without logging in.

---

How It Works :

1. Script Starts

   • Nmap loads the script when you run the command.
   • Lua, the scripting language used by NSE, runs the code inside the script.

2. Target Checking

   • The script first checks if the target server is running Apache on the specified port (usually 80).

3. Sending Special Requests

   • The script sends HTTP requests with crafted paths like ../../etc/passwd.
   • This tries to trick the server into revealing restricted files.

4. Analyzing Response

   • The server’s response is analyzed.
   • If the server returns file content, the script detects it as vulnerable.

5. Reporting

   • If vulnerable, the script outputs:
     • Vulnerability type
     • Risk level
     • Exploitable files
   • If safe, it reports not vulnerable.

Usage

-> Run the script with Nmap like this:

**nmap -p80 --script http-vuln-cve2021-41773

-> Example Output:

PORT STATE SERVICE 80/tcp open http | http-vuln-cve2021-41773: | VULNERABLE: | Apache Path Traversal | State: VULNERABLE | CVE: CVE-2021-41773

-> Requirements :

. Nmap >= 7.91 . Lua support enabled in Nmap . Target server running Apache HTTP

-> Backend Technology Explained :

. Lua: Lightweight scripting language NSE uses for automation. . Nmap Scripting Engine (NSE): Allows writing custom scripts to scan and detect vulnerabilities. . HTTP Requests: The script sends HTTP requests to the server and checks responses. . Path Traversal Attack: Tries to escape web directories and read system files by manipulating file paths (../ sequences).

Author: CHARANVOONNA

References::

CVE-2021-41773 Details : https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773

Nmap NSE Documentation : https://nmap.org/book/nse.html

---