CS4277-CVE-Path-Traversal-Apache-HTTP-Server

Team Members: Emily Nguyen, Jonathan Kim, Joon Jang

Project Topic Selection: Project 1: Recreate and Exploit a Real-World CVE: Path Traversal (CVE-2021-41773) in the Apache HTTP Server.

Project Goal: We hope to reproduce CVE-2021-41773 to deepen our understanding of real-world cybersecurity vulnerabilities so that we can be knowledgeable about exploits in industry and academic work.

Project Overview

This project recreates and analyzes the Apache HTTP Server vulnerability CVE-2021-41773, a path traversal vulnerability that allows attackers to access files outside of the intended web directory.

The project is designed to go beyond simply demonstrating the exploit. We break the work into three parts:

• Part 1 - Vulnerable System + Exploit: Build a vulnerable Apache 2.4.49 server and create a working path traversal exploit that can access files outside the web root.
• Part 2 - Patch Analysis + Comparison: Run the same exploit against both vulnerable (2.4.49) and patched (2.4.51) servers to show that the patch blocks the attack.
• Part 3 - Mitigation Hardening: Apply Apache configuration changes to block the exploit and verify that normal web traffic still works.

Vulnerability Summary

CVE-2021-41773 is caused by incorrect path normalization in Apache’s request handling. Certain encoded traversal patterns are not properly interpreted, allowing attackers to bypass directory restrictions.

Key Results