Apache HTTP Server Path Traversal: CVE-2021-41773/42013
A small explanation of an Apache path traversal bug and an incomplete fix
Last updated
A small explanation of an Apache path traversal bug and an incomplete fix
Last updated
Subscription Required
False [Free]
Type
Walkthrough
Difficulty
Info
Tags
Security, Apache, CVE-2021-41773, CVE-2021-42013
A) Include arbitrary remote files to be processed on the server.
B) Include arbitrary local files to be processed on the server.
C) Allow arbitrary files to be exposed by the server.
D) None of the above.
HINT: Uppercase hex is the preferred standard by the RFC (though lowercase is equivalent, this answer should be in uppercase)
HINT: There are technically two different modules depending on if another module is enabled. This answer uses the shorter of the two.
No answer needed
HINT: The root password is: ApacheCVE
HINT: If you need some help with the shell, visit
2.4.49
Yea
C
%2E
%2e
mod_cgi
THM{724V3R51N6_P4TH5_F02_FUN}
THM{2C3_F20M_C61}
THM{D0UBL3_3NC0D1N6_F7W}
THM{F1L732_8YP455_2C3}
daemon
THM{P21V_35C_F20M_4P4CH3_15_FUN}