emaar1x/cve-2021-41773Educational Docker lab for Apache HTTP Server 2.4.49 path traversal and RCE (CVE-2021-41773) with CVE research, PoC exploit, testing evidence, and mitigation guidance.
⚠️ For isolated, educational lab use ONLY. This repository builds a deliberately vulnerable Apache server. Never run it on a live, production, or internet-facing host.
Red Team internship project by Team Alpha (ITSOLERA — Offensive Security / Exploit Development for a Known CVE). The work is split across six task folders so each member can contribute via their own pull request.
📄 Final report: 06-final-report/CVE-2021-41773-Final-Report.pdf
Apache 2.4.49 decodes a %2e-encoded dot after its path-normalisation check,
so /files/.%2e/.%2e/.%2e/.%2e/etc/passwd escapes the document root. With
mod_cgi enabled, the same trick against /bin/sh gives remote code execution.
| Folder | Owner | Deliverable | Status |
|---|---|---|---|
01-cve-research/ | Fatima Bente Mustafa | CVE summary, affected versions, root cause, CVSS, references | ✅ Done |
02-lab-setup/ | Emaar Ejaz | Vulnerable Apache 2.4.49 Docker lab + SETUP.md | ✅ Done |
03-vulnerability-analysis/ | Anum Aamir Sajjad | ANALYSIS.md + evidence-log.txt | ✅ Done |
04-exploit-poc/ | Noor Saba Basit | cve-2021-41773.py + exploit.sh + logic | ✅ Done |
05-testing-evidence/ | Sana Tariq | Screenshots, terminal output, server logs | ✅ Done |
06-final-report/ | Muhammad Hammad | Compiled final report (PDF) + mitigation | ✅ Done |
The vulnerable target lives in 02-lab-setup/. From inside that
folder:
docker build -t cve-2021-41773-lab:2.4.49 .
docker run -d --name apache-2449-vuln -p 127.0.0.1:8080:80 cve-2021-41773-lab:2.4.49
See 02-lab-setup/SETUP.md for the full setup,
verification, evidence-collection, and troubleshooting guide.
Upgrade to Apache HTTP Server 2.4.51 or later. As defence in depth, keep
<Directory /> at Require all denied by default and only grant access where needed.