CVE-2021-41773 PoC — Apache HTTP Server 路径遍历漏洞

来源

关联漏洞

介绍

# HTTP Apache Path Traversal NSE Script (CVE-2021-41773)

## Description
This NSE script checks if an Apache HTTP Server is vulnerable to the **Path Traversal** vulnerability (CVE-2021-41773).  
A vulnerable server allows attackers to access files they shouldn't, without logging in.

---

## How It Works : 

1. **Script Starts**
   - Nmap loads the script when you run the command.
   - Lua, the scripting language used by NSE, runs the code inside the script.

2. **Target Checking**
   - The script first checks if the target server is running Apache on the specified port (usually 80).

3. **Sending Special Requests**
   - The script sends HTTP requests with **crafted paths** like `../../etc/passwd`.
   - This tries to trick the server into revealing restricted files.

4. **Analyzing Response**
   - The server’s response is analyzed.
   - If the server returns file content, the script detects it as **vulnerable**.

5. **Reporting**
   - If vulnerable, the script outputs:
     - Vulnerability type
     - Risk level
     - Exploitable files
   - If safe, it reports **not vulnerable**.


## Usage

-> Run the script with Nmap like this:

**nmap -p80 --script http-vuln-cve2021-41773 <target-ip> 

-> Example Output:

PORT   STATE SERVICE
80/tcp open  http
| http-vuln-cve2021-41773:
|   VULNERABLE:
|   Apache Path Traversal
|     State: VULNERABLE
|     CVE: CVE-2021-41773


-> Requirements :

. Nmap >= 7.91
. Lua support enabled in Nmap
. Target server running Apache HTTP

-> Backend Technology Explained :

. Lua: Lightweight scripting language NSE uses for automation.
. Nmap Scripting Engine (NSE): Allows writing custom scripts to scan and detect vulnerabilities.
. HTTP Requests: The script sends HTTP requests to the server and checks responses.
. Path Traversal Attack: Tries to escape web directories and read system files by manipulating file paths (../ sequences).

Author:
    CHARANVOONNA

References::

CVE-2021-41773 Details : https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773

Nmap NSE Documentation : https://nmap.org/book/nse.html


---

文件快照

 [4.0K]  /data/pocs/3c9c61546b6a38fa853b67bed99a3c58e6c86aa5
├── [2.1K]  http-vuln-cve2021-41773.nse
└── [2.0K]  README.md

0 directories, 2 files

备注