forked from D-Haiming/gobypoc
-
Notifications
You must be signed in to change notification settings - Fork 2
/
Apache-2.4.49-2.4.50-Path-Traversal-(CVE-2021-42013).json
143 lines (143 loc) · 6.64 KB
/
Apache-2.4.49-2.4.50-Path-Traversal-(CVE-2021-42013).json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
{
"Name": "Apache 2.4.49 2.4.50 Path Traversal (CVE-2021-42013)",
"Description": "<p>Apache is a web server software.</p><p><span style=\"font-size: 16.96px;\">It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient.</span> An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \"require all denied\" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts, this may lead to remote code execution by an attacker.</p>",
"Product": "Apache",
"Homepage": "https://apache.org/",
"DisclosureDate": "2021-10-08",
"Author": "keeeee",
"FofaQuery": "banner=\"apache/2.4.50\" || banner=\"apache/2.4.49\"",
"GobyQuery": "banner=\"apache/2.4.50\" || banner=\"apache/2.4.49\"",
"Level": "2",
"Impact": "<p><span style=\"color: rgb(22, 51, 102); font-size: 16.96px;\">It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient.</span>A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.50. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \"require all denied\" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts, this may lead to remote code execution by an attacker.</p>",
"Translation": {
"CN": {
"Name": "Apache 2.4.49 2.4.50 版本目录穿越漏洞（CVE-2021-41773）",
"VulType": [
"目录遍历"
],
"Tags": [
"目录遍历"
],
"Description": "<p>Apache是一款Web服务器软件。</p><p> Apache HTTP Server 2.4.50 中针对 CVE-2021-41773 的修复不够充分。 攻击者可以使用目录穿越攻击将 URL 映射到预期文档根目录之外的文件。 如果文档根目录之外的文件不受“要求全部拒绝”的保护，则这些请求可能会成功。 此外，此缺陷可能会泄漏 CGI 脚本等解释文件的来源，进而可能导致攻击者实现远程代码执行。</p>",
"Impact": "<p> Apache HTTP Server 2.4.50 中针对 CVE-2021-41773 的修复不够充分。 攻击者可以使用目录穿越攻击将 URL 映射到预期文档根目录之外的文件。 如果文档根目录之外的文件不受“要求全部拒绝”的保护，则这些请求可能会成功。 此外，此缺陷可能会泄漏 CGI 脚本等解释文件的来源，进而可能导致攻击者实现远程代码执行。</p>",
"Product": "Apache",
"Recommendation": "<p>⼚商已发布了漏洞修复程序，请及时关注更新： <a href=\"https://httpd.apache.org/security/vulnerabilities_24.html\">https://httpd.apache.org/security/vulnerabilities_24.html</a></p>"
},
"EN": {
"Name": "Apache 2.4.49 2.4.50 Path Traversal (CVE-2021-41773)",
"VulType": [
"path-traversal"
],
"Tags": [
"path-traversal"
],
"Description": "<p>Apache is a web server software.</p><p>It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \"require all denied\" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts, this may lead to remote code execution by an attacker.</p>",
"Impact": "<p>It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \"require all denied\" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts, this may lead to remote code execution by an attacker.</p>",
"Product": "Apache",
"Recommendation": "<p>The vendor has released a bug fix, please pay attention to the update in time: <a href=\"https://httpd.apache.org/security/vulnerabilities_24.html\">https://httpd.apache.org/security/vulnerabilities_24.html</a></p><p>1. Set access policies and whitelist access through security devices such as firewalls.</p><p>2.Upgrade the Apache system version.</p>"
}
},
"References": [
"https://nvd.nist.gov/vuln/detail/CVE-2021-41773",
"https://twitter.com/roman_soft/status/1446252280597078024"
],
"HasExp": true,
"ExpParams": [
{
"name": "filename",
"type": "input",
"value": "/etc/passwd"
}
],
"ExpTips": null,
"ScanSteps": [
"AND",
{
"Request": {
"method": "GET",
"uri": "/test.php",
"follow_redirect": true,
"header": {},
"data_type": "text",
"data": ""
},
"ResponseTest": {
"type": "group",
"operation": "AND",
"checks": [
{
"type": "item",
"variable": "$code",
"operation": "==",
"value": "200",
"bz": ""
},
{
"type": "item",
"variable": "$body",
"operation": "contains",
"value": "test",
"bz": ""
}
]
},
"SetVariable": []
}
],
"ExploitSteps": [
"AND",
{
"Request": {
"method": "GET",
"uri": "/test.php",
"follow_redirect": true,
"header": {},
"data_type": "text",
"data": ""
},
"ResponseTest": {
"type": "group",
"operation": "AND",
"checks": [
{
"type": "item",
"variable": "$code",
"operation": "==",
"value": "200",
"bz": ""
},
{
"type": "item",
"variable": "$body",
"operation": "contains",
"value": "test",
"bz": ""
}
]
},
"SetVariable": []
}
],
"Tags": [
"path-traversal"
],
"VulType": [
"path-traversal"
],
"CVEIDs": [
"CVE-2021-41773"
],
"CVSSScore": "9.0",
"AttackSurfaces": {
"Application": null,
"Support": null,
"Service": null,
"System": [
"Apache"
],
"Hardware": null
},
"CNNVD": [],
"CNVD": [],
"Recommandation": "<p>The vendor has released a bug fix, please pay attention to the update in time: <a href=\"https://httpd.apache.org/security/vulnerabilities_24.html\" target=\"_blank\">https://httpd.apache.org/security/vulnerabilities_24.html</a><br></p>"
}