Apache HTTP Server 2.4.49/2.4.50 RCE (CVE-2021-42013) — Hackviser

Description

Apache HTTP Server is a popular open-source web server used to host and serve web content. This laboratory contains the CVE-2021-42013 vulnerability found in Apache HTTP Server versions 2.4.49 and 2.4.50. This vulnerability allows attackers to perform path traversal and remote code execution attacks, enabling the execution of arbitrary commands on the server and potentially taking control of the system. The goal is to read the secret in /secret.txt.

English summary: An Apache HTTP Server 2.4.50 instance is vulnerable to CVE-2021-42013. The goal is to exploit the path traversal / RCE vulnerability to read /secret.txt from the filesystem root.

Analysis

CVE-2021-42013 is a path traversal vulnerability in Apache HTTP Server versions 2.4.49 and 2.4.50. It is a bypass of the incomplete fix for CVE-2021-41773 (which was patched in 2.4.50 but insufficiently).

The core issue: Apache's path normalization checks for ../ sequences, but double URL encoding bypasses this check:

• %%32%65 → first decode → %2e → second decode → .
• So %%32%65%%32%65/ decodes to ../ after both decoding passes

When the traversal path goes through a ScriptAlias directive (like /cgi-bin/), Apache treats the resolved path as a CGI script and executes it. By traversing to /bin/sh, an attacker can execute arbitrary shell commands via POST body — escalating path traversal to Remote Code Execution.

Key prerequisites:

1. Apache 2.4.49 or 2.4.50
2. mod_cgi or mod_cgid enabled
3. A ScriptAlias directive (e.g., /cgi-bin/)
4. The Require all granted or permissive directory configuration

Solution

Step 1: Reconnaissance

Identified the target Apache version from HTTP response headers:

curl -sI http://172.20.1.166/

HTTP/1.1 200 OK
Server: Apache/2.4.50 (Unix)

Apache 2.4.50 — vulnerable to CVE-2021-42013.

...