r0otk3r/cve-2021-41773Python exploit for Apache HTTP Server path traversal (CVE-2021-41773 & CVE-2021-42013) enabling LFI and RCE via CGI. For authorized security testing and research.
CVE-2021-41773 & CVE-2021-42013
These are critical path traversal vulnerabilities affecting Apache HTTP Server 2.4.49 and 2.4.50.
They allow attackers to:
Both vulnerabilities are patched in Apache 2.4.51.
Immediate upgrading is strongly recommended.
python3 exploit.py --url <TARGET> --port [PORT] (--rce --command "COMMAND" | --lfi --path "/path/to/file")
Examples
python3 exploit.py --url http://192.168.1.10 --rce --command "id"
python3 exploit.py --url http://192.168.1.10 --lfi --path "/etc/passwd"
This exploit script is for authorized security testing, defensive research, and educational purposes only.