Apache httpd 2.4.50 incomplete traversal fix

Apache httpd 2.4.50 was the first attempt to fix CVE-2021-41773, and it left a gap: a path that is URL-encoded twice still gets past the check. There are two playbooks for this CVE. One builds 2.4.50 with the root directory opened up as a file-access target. The other builds it with the prefork MPM, mod_cgi loaded and CGI execution allowed on the root directory. Both start the service and stop there.

Remote code execution bugs are the ones defenders care about most. This target is useful for testing detection rules and logging.

Product

Apache httpd

Version

2.4.50

Type

RCE

Severity

Critical

Port

80/tcp

This playbook needs the setup from the earlier steps. Check these first.

• The base VM from Step 01 is built and reachable over SSH.
• You cloned the playbooks repo and set inventory/hosts.ini in Step 02.
• A snapshot named clean-base exists, and the machine is booted from it.

One CVE at a time. Don't run this on top of another playbook. Reset first.

Boot the machine from clean-base, then run the playbook for CVE-2021-42013. It installs Apache httpd 2.4.50, sets up its config and starts the service.

ansible-playbook cve/cve-2021-42013.yml 

A clean run ends with a recap that shows failed=0. If it fails partway, run it again.

The verify tag checks that the service is listening and running the version this CVE affects. Run it from the host.

ansible-playbook cve/cve-2021-42013.yml  --tags verify

You should see target OK.

- Requests with doubly encoded dot sequences in the URL path - Access log entries under /cgi-bin/ that resolve to paths outside the web root - Unexpected child processes started by httpd - A Server header or banner showing Apache/2.4.50

Fixed in Apache httpd 2.4.51, which reworked how encoded path segments are decoded and checked. Upgrade to 2.4.51 or later, and keep the root directory set to Require all denied.

Restore clean-base. Nothing from this playbook carries over.

VBoxManage controlvm thehackingmachine acpipowerbutton
VBoxManage snapshot thehackingmachine restore clean-base
VBoxManage startvm thehackingmachine

• https://nvd.nist.gov/vuln/detail/CVE-2021-42013
• https://httpd.apache.org/security/vulnerabilities_24.html

Playbook and write-up by TheHackingMachine Team.

Want to add your own? See how to contribute.