Apache httpd 2.4.49 path traversal

Apache httpd 2.4.49 does not normalise some encoded paths correctly, so a request can reach files outside the web root. The playbook builds 2.4.49 from source with mod_cgi enabled, relaxes the root directory access rule (Require all granted), and starts the service as a systemd unit. Good for practising config review and patch checks.

Web server path bugs are common in real audits. This target is useful for practicing config review and patch checks.

Product

Apache httpd

Version

2.4.49

Type

Traversal

Severity

High

Port

80/tcp

This playbook needs the setup from the earlier steps. Check these first.

• The base VM from Step 01 is built and reachable over SSH.
• You cloned the playbooks repo and set inventory/hosts.ini in Step 02.
• A snapshot named clean-base exists, and the machine is booted from it.

One CVE at a time. Don't run this on top of another playbook. Reset first.

Boot the machine from clean-base, then run the playbook for CVE-2021-41773. It installs Apache httpd 2.4.49, sets up its config and starts the service.

ansible-playbook cve/cve-2021-41773.yml 

A clean run ends with a recap that shows failed=0. If it fails partway, run it again.

The verify tag checks that the service is listening and running the version this CVE affects. Run it from the host.

ansible-playbook cve/cve-2021-41773.yml  --tags verify

You should see target OK.

- Requests to the web server with encoded dot sequences in the URL path - Access log entries under /cgi-bin/ or /icons/ that resolve to paths outside the web root - Unexpected child processes started by httpd - A Server header or banner showing Apache/2.4.49

Fixed in Apache httpd 2.4.50, which tightened path normalisation. That fix was incomplete, see CVE-2021-42013. Upgrade to 2.4.51 or later, and keep the root directory set to Require all denied.

Restore clean-base. Nothing from this playbook carries over.

VBoxManage controlvm thehackingmachine acpipowerbutton
VBoxManage snapshot thehackingmachine restore clean-base
VBoxManage startvm thehackingmachine

• https://nvd.nist.gov/vuln/detail/CVE-2021-41773
• https://httpd.apache.org/security/vulnerabilities_24.html

Playbook and write-up by TheHackingMachine Team.

Want to add your own? See how to contribute.