gagaltotal/CVE-2021-41773-apache

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based exploit for CVE-2021-41773 that sends crafted POST requests to a vulnerable Apache HTTP Server 2.4.49 to achieve remote code execution via path traversal and CGI. It includes verification, single-command execution, and an interactive shell.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README, a Python exploit script, and a requirements file for CVE-2021-41773. The exploit script performs only the advertised path traversal and remote code execution against a user-supplied target. No concealed, deceptive, or operator-directed harmful behavior such as credential theft, unrelated remote access, persistence, or an unrelated payload was observed. The script's functionality is limited to sending crafted HTTP requests to the specified target and displaying the response.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareApache HTTP Server 2.4.49
Attack typespath traversalremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains code that sends crafted HTTP requests to execute arbitrary commands on a remote target, which is the definition of an exploit. The README and script both describe it as an exploit and a PoC for remote code execution.

exploit.py:2exploit.py:98-120README.md:1-3

Requirements

  • Target must be running Apache HTTP Server 2.4.49 with CGI enabled and a vulnerable configuration.exploit.py:2-6README.md:7

Observed behavior

  • Sends a POST request to /cgi-bin/.%2e/%2e%2e.../bin/sh with a command payload to execute arbitrary commands on the target server.exploit.py:28exploit.py:94-96exploit.py:98-120
  • Verifies vulnerability by checking if the response contains the string 'VULNERABLE' after executing 'echo VULNERABLE'.exploit.py:134-160
  • Provides an interactive shell that repeatedly prompts for commands and prints the response.exploit.py:162-193
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The script sends a POST request with a path traversal payload to /cgi-bin/.%2e/%2e%2e.../bin/sh on the user-supplied target, executing a shell command provided by the user.This is the expected behavior for a CVE-2021-41773 proof-of-concept exploit.exploit.py:28exploit.py:90-96exploit.py:98-132
Network Communication
The script communicates only with the target specified by the user via the -t argument.No connections to unrelated external hosts are made.exploit.py:35-37exploit.py:90-92
User Interaction
The script requires explicit user input to specify a target and command, and does not perform any automated actions beyond the user's request.No autonomous or hidden behavior is present.exploit.py:196-233exploit.py:236-275
Review boundaries

What the analysis did not establish

  • One non-text media file (screenshot) was not analyzed; its content is not needed for classification.
  • One text file (likely a license or similar) was omitted from the packet; its absence does not affect classification.
  • The evidence does not include execution results or verification that the exploit works.
  • One non-text media file (images/Screenshot from 2026-07-23 16-52-21.png, 692300 bytes) was flagged as binary and not analyzed. Its content could not be reviewed.
  • One text file (images/README.md) was omitted from the selected text evidence and not reviewed.
  • The analysis is limited to the supplied evidence and does not include dynamic analysis or execution of the code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1