kunalkhandelwal-dev/cve-2021-41773-labEducational FastAPI lab demonstrating CVE-2021-41773 directory traversal and local file inclusion, with a vulnerable server, patched code, and encoded payload examples for local security training.
A small, self-contained FastAPI lab demonstrating how decoding user input before validating filesystem boundaries can lead to directory traversal and local file inclusion (LFI), modeled after the Apache HTTP Server issues CVE-2021-41773.
%2e) and double-encoded (%252e) bypassescurluvicornInstall runtime dependencies:
pip install fastapi uvicorn
python -m venv venv
.\venv\Scripts\activate
pip install fastapi uvicorn
uvicorn vulnerable_app:app --port 8011
Open http://127.0.0.1:8011/ in your browser — the root endpoint shows common payloads and notes.
To observe the fix, stop the vulnerable server and run the patched server:
uvicorn patched_app:app --port 8011
curl --path-as-is http://localhost:8011/icons/test.txt
curl --path-as-is "http://localhost:8011/icons/.%2e/secret.txt"
curl --path-as-is "http://localhost:8011/icons/.%252e/secret.txt"
Against the vulnerable server these payloads may return secret.txt. Against the patched server they should be rejected (HTTP 403).
os.path.realpath().webroot directory — deny otherwise.This enforces correct ordering: decode → canonicalize → authorize.
This repository is for local, educational use only. Do not expose the vulnerable server to public networks.
MIT License
Kunal Khandelwal — Security Researcher, Application Security