what you don't know can hurt you
Showing 1 - 5 of 5 RSS Feed

CVE-2021-42013

Status Candidate

Overview

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Related Files

Apache HTTP Server 2.4.50 CVE-2021-42013 Exploitation
Posted Nov 29, 2021
Authored by Apaar Farmaha, Aman Saxena, Shlok Yadav

This document aims at explaining some recent vulnerabilities in Apache HTTP Server that leads to attacks like path traversal and remote code execution.

tags | exploit, paper, remote, web, vulnerability, code execution
advisories | CVE-2021-42013
SHA-256 | f1aae18afbd9ad17a4af83ba0fe8f963226438309f210e48576d57b0bdf705a2
Apache HTTP Server 2.4.50 Remote Code Execution
Posted Nov 11, 2021
Authored by Valentin Lobstein, Lucas Schnell

This is another variant of the Apache HTTP server version 2.4.50 remote code execution exploit.

tags | exploit, remote, web, code execution
advisories | CVE-2021-41773, CVE-2021-42013
SHA-256 | 1aab010960ead5e3662859fd06680b20932ece6ecf7a7c80a05437497896bb8f
Apache 2.4.49 / 2.4.50 Traversal / Remote Code Execution
Posted Oct 25, 2021
Authored by Dhiraj Mishra, Ramella Sebastien, Ash Daulton | Site metasploit.com

This Metasploit module exploits an unauthenticated remote code execution vulnerability which exists in Apache version 2.4.49 (CVE-2021-41773). If files outside of the document root are not protected by ‘require all denied’ and CGI has been explicitly enabled, it can be used to execute arbitrary commands. This vulnerability has been reintroduced in the Apache 2.4.50 fix (CVE-2021-42013).

tags | exploit, remote, arbitrary, cgi, root, code execution
advisories | CVE-2021-41773, CVE-2021-42013
SHA-256 | a75779abdd3a9f2a319a34c0efbba4f95b420f39624081c3a13752641b7c8d6d
Apache HTTP Server 2.4.50 Remote Code Execution
Posted Oct 24, 2021
Authored by thelastvvv

Apache HTTP Server version 2.4.50 remote code execution exploit.

tags | exploit, remote, web, code execution
advisories | CVE-2021-42013
SHA-256 | 486eba2974d21ce35aa31dc7a6504701fc48220f6cf03add5457f12164885ccf
Apache HTTP Server 2.4.50 Path Traversal / Code Execution
Posted Oct 13, 2021
Authored by Lucas Souza

Apache HTTP Server version 2.4.50 suffers from path traversal and code execution vulnerabilities.

tags | exploit, web, vulnerability, code execution, file inclusion
advisories | CVE-2021-42013
SHA-256 | 75aa94003e00f9bc304726a005c80e01c7bce1e6aabc71988646f014ecb8e58e
Page 1 of 1
Back1Next

File Archive:

May 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    0 Files
  • 2
    May 2nd
    15 Files
  • 3
    May 3rd
    19 Files
  • 4
    May 4th
    24 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    14 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    0 Files
  • 9
    May 9th
    13 Files
  • 10
    May 10th
    7 Files
  • 11
    May 11th
    99 Files
  • 12
    May 12th
    45 Files
  • 13
    May 13th
    7 Files
  • 14
    May 14th
    0 Files
  • 15
    May 15th
    0 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    26 Files
  • 18
    May 18th
    4 Files
  • 19
    May 19th
    17 Files
  • 20
    May 20th
    2 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    6 Files
  • 24
    May 24th
    19 Files
  • 25
    May 25th
    5 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close