0xc4t/CVE-2021-41773

GitHubRepository PoC

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2021-41773Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker-based lab for CVE-2021-41773, an Apache HTTP Server 2.4.49 path traversal and potential remote code execution vulnerability. It builds a container from httpd:2.4.49 with a custom httpd.conf and exposes port 80 on host port 81.

Dockerfile:1-2README.md:1-24

Lab assessment

Vulnerability lab

The README explicitly states 'POC & Lab For CVE-2021-41773', provides setup instructions using Docker, and includes proof-of-concept curl commands demonstrating the vulnerability.

README.md:1-24
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

httpd:2.4.49 container

vulnerable target

Apache HTTP Server version 2.4.49, the version known to be vulnerable to CVE-2021-41773. Configured with a custom httpd.conf that enables CGI via mod_cgid and sets up a /cgi-bin/ directory.

Dockerfile:1httpd.conf:1-562

httpd.conf

server configuration

Custom Apache configuration file copied into the container. It enables modules including cgid, alias, and headers, sets DocumentRoot to /usr/local/apache2/htdocs, and configures a ScriptAlias for /cgi-bin/ pointing to /usr/local/apache2/cgi-bin/. This configuration is necessary for the RCE PoC to work.

Dockerfile:2httpd.conf:1-562
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2021-41773

Supported by supplied evidence

The lab uses Apache HTTP Server 2.4.49, the exact version affected by CVE-2021-41773. The README provides PoC commands that exploit path traversal and CGI execution, matching the known vulnerability description.

Dockerfile:1README.md:1-24
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.README.md:7-10
  • The lab must be built with 'docker build -t cve-2021-41773 .' and run with 'docker run --name cve-2021-41773 -p 81:80 cve-2021-41773'.README.md:9-10

Evidence-described exercise path

  1. Clone the repository and navigate into the directory.README.md:7-8
  2. Build the Docker image.README.md:9
  3. Run the container, mapping host port 81 to container port 80.README.md:10
  4. Execute the RCE PoC: curl to /cgi-bin/ with path traversal to /bin/sh and POST data to run 'whoami'.README.md:14-15
  5. Execute the LFI PoC: curl to /cgi-bin/ with path traversal to read /etc/passwd.README.md:18
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The lab is a self-contained vulnerability reproduction environment. The Dockerfile only copies a configuration file; no hidden or destructive commands are present. The PoC commands target the lab's own container and do not attempt to escape to the host or external systems. Port mapping is a standard lab requirement.

Dockerfile:1-2README.md:1-24
Review boundaries

What the analysis did not establish

  • The packet does not include a docker-compose.yml or other orchestration files, so the lab is limited to a single container.
  • No runtime verification of the vulnerability is provided; the analysis is based solely on static configuration and documentation.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1