shiomiyan/CVE-2021-41773

GitHubRepository PoC

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

2
GitHub

windows

Created Vuln labCVE-2021-41773Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Windows Server Core container running Apache HTTP Server 2.4.50, configured with TLS and CGI support. The README associates the environment with CVE-2021-41773.

windows/Dockerfile:1-21windows/README.md:1-6

Lab assessment

Vulnerability lab

The README explicitly names CVE-2021-41773 and provides build/run instructions, indicating a vulnerability reproduction environment. The Dockerfile installs Apache 2.4.50, a version known to be affected by that CVE.

windows/README.md:1-6windows/Dockerfile:5
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Windows Server Core base image

operating system

Provides the Windows OS environment for the Apache server.

windows/Dockerfile:1

Apache HTTP Server 2.4.50

web servervulnerable target

Downloaded from apachehaus.com and installed in C:\Apache24. Configured via httpd.conf to listen on port 80, serve documents, and support CGI scripts.

windows/Dockerfile:5windows/httpd.conf:1-551

Visual C++ Redistributable

runtime dependency

Installed silently to satisfy Apache's runtime requirements.

windows/Dockerfile:10

Custom httpd.conf

server configuration

Copied into the image to configure Apache. Enables modules like mod_cgi, mod_alias, mod_ssl, and sets up a ScriptAlias for /cgi-bin/.

windows/Dockerfile:15windows/httpd.conf:1-551
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2021-41773

Supported by supplied evidence

The Dockerfile installs Apache HTTP Server 2.4.50, which is a version explicitly listed as vulnerable to CVE-2021-41773 (a path traversal and file disclosure vulnerability). The README names the CVE, confirming the lab's purpose.

windows/Dockerfile:5windows/README.md:1-6
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker with Windows containers support must be available.windows/README.md:1
  • The builder must have network access to download Apache and the VC++ redistributable during image build.windows/Dockerfile:5windows/Dockerfile:10

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.windows/README.md:3
  2. Run a container from the image, mapping host port 8080 to container port 80.windows/README.md:4
  3. Exploit CVE-2021-41773 against the running Apache server (e.g., path traversal to access files outside the document root or execute CGI scripts).windows/README.md:1-6
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile and configuration only set up a vulnerable Apache server inside a container. No hidden or unnecessary host/external compromise, persistence, credential theft, or destructive behavior is visible. The port mapping (8080:80) is a standard lab requirement for accessing the target service.

windows/Dockerfile:1-21windows/README.md:1-6
Review boundaries

What the analysis did not establish

  • The packet does not include the actual exploit payload or proof-of-concept code; only the vulnerable environment is provided.
  • The httpd.conf includes an SSL module and references an extra configuration file (httpd-ahssl.conf) that is not supplied, so the full TLS configuration is unknown.
  • The README instructions are minimal and do not detail the exact exploitation steps.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

unix

Created Vuln labCVE-2021-41773Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile builds a container from httpd:2.4.49-alpine, copies a custom httpd.conf, and the README instructs building and running it with port 8000:80. The environment is a minimal Apache HTTP Server 2.4.49 instance.

unix/Dockerfile:1-3unix/README.md:1-7

Lab assessment

Vulnerability lab

The repository is named CVE-2021-41773, the README references CVE-2021-41773, and the Dockerfile uses the vulnerable httpd:2.4.49-alpine image. The environment is structured to demonstrate or reproduce the CVE-2021-41773 path traversal vulnerability.

unix/README.md:1-7unix/Dockerfile:1
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

httpd server

vulnerable target

Apache HTTP Server version 2.4.49 running on Alpine Linux, configured with a custom httpd.conf that enables mod_alias, mod_cgi, and a ScriptAlias for /cgi-bin/. This version is known to be vulnerable to CVE-2021-41773 path traversal.

unix/Dockerfile:1unix/httpd.conf:1-550
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2021-41773

Supported by supplied evidence

The Dockerfile explicitly uses httpd:2.4.49-alpine, which is the exact version affected by CVE-2021-41773. The custom httpd.conf enables mod_alias and mod_cgi, which are required for the path traversal exploit. The repository name and README both reference CVE-2021-41773.

unix/Dockerfile:1unix/README.md:1-7unix/httpd.conf:1-550
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.unix/README.md:3-5
  • The attacker must be able to send HTTP requests to the running container on port 8000.unix/README.md:5

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.unix/README.md:3
  2. Run the container, mapping host port 8000 to container port 80.unix/README.md:5
  3. Exploit the CVE-2021-41773 path traversal vulnerability by sending a crafted HTTP request to the server, e.g., using a URL-encoded path to access files outside the document root or execute arbitrary commands via CGI.unix/httpd.conf:1-550
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile only copies a configuration file into a known vulnerable Apache image. The README provides standard Docker build and run commands with a port mapping. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior is present. The environment is a self-contained vulnerability lab targeting the containerized Apache server.

unix/Dockerfile:1-3unix/README.md:1-7
Review boundaries

What the analysis did not establish

  • The packet does not include any exploit script or proof-of-concept code, only the vulnerable server configuration.
  • The httpd.conf is a standard Apache configuration with minor modifications; no explicit exploit payload is visible.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1