CVE-2021-42013 (Apache 2.4.50)

• Type: Path Traversal + Remote Code Execution
• CVSS Score: 9.8 Critical
• Affected Versions: Apache HTTP Server 2.4.50
• Root Cause: Insufficient fix for CVE-2021-41773, allows double URL encoding (%%32%65) bypass
• Impact: Same as CVE-2021-41773, affects the patched version

Features

✅ Dual CVE Detection: Tests for both CVE-2021-41773 and CVE-2021-42013 ✅ Path Traversal Testing: Multiple payload variations for file access attempts ✅ RCE Testing: Remote code execution verification if mod_cgi is enabled ✅ Batch Scanning: Scan multiple targets from a file ✅ Color-Coded Output: Easy-to-read formatted results ✅ Customizable Timeout: Adjustable request timeout for unreliable networks ✅ User-Agent Spoofing: Bypasses basic filtering mechanisms

Requirements

• Python 3.6+
• requests library
• colorama library

Installation

Clone the Repository

Install Dependencies

Or manually install:

Usage

Single Target Scan

HTTPS Target

Custom Timeout

Batch Scanning

Help

Command-Line Arguments

Example Usage

Single Target

Multiple Targets

Create targets.txt:

Then run:

Extended Timeout for Slow Networks

Output

The scanner provides detailed output including:

• Vulnerability Detection Status: Whether each CVE is detected
• Payload Information: Which payload triggered the vulnerability
• Response Data: Sample of the server response
• Recommendations: Patching guidance

Example output:

How It Works

CVE-2021-41773 Detection

1. Sends requests with single URL-encoded payloads (.%2e)
2. Targets alias directories: /cgi-bin/, /icons/, /images/
3. Attempts to read /etc/passwd and /etc/shadow
4. Tests command execution via POST requests

CVE-2021-42013 Detection

1. Sends requests with double URL-encoded payloads (%%32%65)
2. Uses same target directories as CVE-2021-41773
3. Bypasses the insufficient patch in Apache 2.4.50
4. Verifies RCE capability if mod_cgi is enabled

RCE Testing

• Executes id command to verify code execution
• Works only if mod_cgi module is enabled
• Looks for uid= and gid= in response

Detection Indicators

The scanner looks for:

• Successful path traversal: Response contains root: or daemon: entries from /etc/passwd
• Successful RCE: Response contains uid= and gid= from id command execution
• HTTP Status Code: 200 OK with expected content

Mitigation

Immediate Actions

1. Upgrade Apache HTTP Server to version 2.4.51 or later
2. Disable mod_cgi if not required
3. Apply strict directory restrictions:
   root@kitploit:~

   <Directory />
       Require all denied
   </Directory>
   

Configuration Hardening

Version Check

Supported Apache Versions

Disclaimer

⚠️ IMPORTANT: This tool is intended ONLY for authorized security testing and educational purposes. Unauthorized access to computer systems is ILLEGAL under laws like the Computer Fraud and Abuse Act (CFAA) and similar legislation worldwide.

Authorized Use Only:

• Penetration testing with written permission
• Security audits of your own infrastructure
• CTF competitions and training platforms (TryHackMe, HackTheBox, etc.)
• Educational and research purposes

Misuse Warning: Users are responsible for ensuring they have explicit authorization before testing any target. The authors assume no liability for unauthorized use.

Use Cases

This scanner is ideal for:

Security Professionals

• Vulnerability assessment and management
• Penetration testing engagements
• Security audits of Apache infrastructure
• Compliance verification (PCI-DSS, etc.)

System Administrators

• Identifying vulnerable Apache instances
• Validating patch deployment
• Infrastructure security audits
• Server inventory scanning

Cybersecurity Students

• Learning vulnerability exploitation
• Understanding path traversal attacks
• CTF challenge solving
• Security research and education

DevOps/DevSecOps

• Infrastructure vulnerability scanning
• CI/CD pipeline security checks
• Container scanning (if running Apache)
• Pre-deployment security verification

Files

Configuration Files

requirements.txt

targets.txt (Example)

Troubleshooting

Issue: Connection Timeout

Solution: Increase timeout with -t option

Issue: SSL Certificate Error

Solution: The script disables SSL verification by default. If issues persist, ensure Python certificates are updated:

Issue: Module Not Found

Solution: Ensure all dependencies are installed

Issue: Permission Denied

Solution: Make the script executable

Performance Tips

• Batch Scanning: Use -l with a target file for multiple scans
• Parallel Scanning: For large-scale scanning, run multiple instances with task splitting
• Timeout Optimization: Lower timeout values for fast networks, higher for slow connections
• Target Validation: Verify targets are reachable before batch scanning

References

• NVD CVE-2021-41773
• NVD CVE-2021-42013
• Apache HTTP Server Security Advisory
• Qualys Security Research
• CISA Alert AA21-265A

Contributing

Contributions are welcome! To contribute:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/improvement)
3. Commit your changes (git commit -m 'Add improvement')
4. Push to the branch (git push origin feature/improvement)
5. Submit a Pull Request

Please ensure:

• Code follows PEP 8 standards
• Comments explain complex logic
• Payloads are tested for effectiveness
• README is updated if adding features

License

This project is licensed under the MIT License. See the LICENSE file for details.

Author

Security Testing Tool
Created for educational and authorized security testing purposes.

For questions, issues, or suggestions, please open an issue on GitHub.

Changelog

Version 1.0.0 (Initial Release)

• ✅ CVE-2021-41773 detection
• ✅ CVE-2021-42013 detection
• ✅ Path traversal testing
• ✅ RCE capability verification
• ✅ Batch scanning support
• ✅ Color-coded output
• ✅ Customizable timeout

Security Notes

• The scanner sends HTTP requests to target servers
• It does not modify any files on target systems
• SSL verification is disabled for flexibility
• User-Agent is spoofed to bypass basic filtering
• Results should be validated before taking action
• Always maintain logs of authorized testing

Last Updated: November 2025
Status: Active Development
Tested On: Python 3.8+, Apache 2.4.49, 2.4.50