Apache HTTP Server CVE-2021-41773 Source Code Analysis

A Python-based static patch analysis tool for studying the root cause and remediation of CVE-2021-41773 (Apache HTTP Server Path Traversal) by comparing the vulnerable Apache HTTP Server 2.4.49 source code with the patched 2.4.51 implementation.

The project performs semantic source code analysis instead of simple text-based diffing. It extracts structural information from the target function, compares both versions, infers security-relevant changes, and generates professional analysis reports.

Features

Static source code analysis
Function extraction using brace matching
Structural comparison between vulnerable and patched versions
Security capability detection
Patch reasoning engine
Markdown report generation
JSON report generation
HTML report generation
Automated Docker lab setup
Environment verification tool

Project Architecture

Apache Source Code
        │
        ▼
 parser.py
        │
        ▼
 extractor.py
        │
        ▼
 comparator.py
        │
        ▼
 reasoning.py
        │
        ▼
 reports.py

Project Structure

cve-2021-41773-source-code-analysis
│
├── docker
│   ├── apache249
│   │   ├── Dockerfile              # Builds Apache HTTP Server 2.4.49 container
│   │   └── docker-compose.yml      # Starts vulnerable Apache container
│   │
│   └── apache251
│       ├── Dockerfile              # Builds Apache HTTP Server 2.4.51 container
│       └── docker-compose.yml      # Starts patched Apache container
│
├── labs                            # Stores downloaded Apache source code
│
├── references
│   └── resources.md                # Reference material for CVE research
│
├── scripts
│   ├── patch_analysis
│   │   ├── __init__.py             # Initializes the analysis package
│   │   ├── parser.py               # Extracts target C functions from Apache source
│   │   ├── extractor.py            # Extracts variables, calls, conditions and security capabilities
│   │   ├── comparator.py           # Compares vulnerable and patched function structures
│   │   ├── reasoning.py            # Performs security reasoning on detected changes
│   │   ├── reports.py              # Coordinates report generation
│   │   ├── markdown_report.py      # Generates Markdown analysis report
│   │   ├── json_report.py          # Generates JSON analysis report
│   │   └── html_report.py          # Generates HTML analysis report
│   │
│   ├── analyze_patch.py            # Main entry point for patch analysis
│   ├── verify_lab.py               # Verifies Docker lab configuration
│   └── debug.py                    # Displays raw comparison output for debugging
│
├── analysis                        # Generated analysis reports
│
├── setup.sh                        # Automatically prepares the complete lab
│
├── LICENSE
└── README.md

Requirements

Python 3.10+
Docker
Docker Compose
Bash
Linux (Tested on Kali Linux)

Installation

Clone the repository

git clone https://github.com/KunalKhandelwal-dev/cve-2021-41773-source-code-analysis.git

Enter the project

cd cve-2021-41773-source-code-analysis

Setup

Run the automated setup script.

sudo bash setup.sh

The setup script automatically performs the following tasks:

Checks required tools
Verifies Docker installation
Downloads Apache HTTP Server 2.4.49
Downloads Apache HTTP Server 2.4.51
Extracts both source trees
Builds Docker images
Starts Apache containers
Creates the analysis environment

Example output

[INFO] Checking required tools...
[SUCCESS] Required tools found.

[INFO] Checking Docker...
[SUCCESS] Docker is running.

[INFO] Downloading Apache HTTP Server 2.4.49...
[SUCCESS] Apache 2.4.49 downloaded.

[INFO] Downloading Apache HTTP Server 2.4.51...
[SUCCESS] Apache 2.4.51 downloaded.

[INFO] Building Docker images...
[SUCCESS] Docker images built.

[INFO] Starting Apache containers...
[SUCCESS] Containers started.

=========================================================
[SUCCESS] Apache CVE Lab Setup Complete
=========================================================

Verify the Environment

Run

cd scripts

sudo python3 verify_lab.py

Successful verification

The verification tool checks:

Docker installation
Docker daemon
Running containers
Apache versions
Apache source code
Target function
HTTP services
GDB availability

Run Patch Analysis

Move into the scripts directory.

cd scripts

Run

sudo python3 analyze_patch.py

Example output

Sample Analysis Output

Apache HTTP Server Patch Analysis Report

Security Findings

[MEDIUM]
Percent decoding introduced or modified

[MEDIUM]
Hexadecimal validation introduced or modified

[HIGH]
Directory traversal handling improved

[HIGH]
Path normalization pipeline updated

[CRITICAL]
Traversal protection strengthened

Generated Reports

After successful execution the following reports are generated:

analysis/
├── analysis.md
├── analysis.json
└── analysis.html

Analysis Pipeline

Load Apache Source
        │
        ▼
Extract Target Function
        │
        ▼
Extract Structural Information
        │
        ▼
Compare Vulnerable vs Patched
        │
        ▼
Security Reasoning
        │
        ▼
Generate Reports

Security Capabilities Detected

Percent Encoding / Decoding
Hexadecimal Validation
Dot Segment Handling
Path Separator Normalization
URI Normalization Flags
Directory Traversal Protection

Generated Findings

The reasoning engine identifies security improvements such as:

Percent decoding introduced
Hexadecimal validation introduced
Directory traversal handling improved
Path normalization updated
Traversal protection strengthened

Educational Purpose

This project is intended for:

Security researchers
Students learning CVE root cause analysis
Secure software engineering
Static source code analysis
Patch diff analysis
Vulnerability research

License

This project is released under the MIT License.

Author

Kunal Khandelwal

B.Tech Computer Science Engineering (Cyber Security)

Security Research | Application Security | Docker | Source Code Analysis

cve-2021-41773-source-code-analysis

सबसे लोकप्रिय