CVE-2004-0173

published 2004-04-15

CVE-2004-0173: Directory traversal vulnerability in Apache 1.3.29 and earlier, and Apache 2.0.48 and earlier, when running on Cygwin, allows remote attackers to read…

Priority P4 31 medium 5 CVSS 2.0

AV N AC L Au N C P I N A N

EXPLOIT

Directory traversal vulnerability in Apache 1.3.29 and earlier, and Apache 2.0.48 and earlier, when running on Cygwin, allows remote attackers to read arbitrary files via a URL containing "..%5C" (dot dot encoded backslash) sequences.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
apache	http_server	—	—
apache	http_server	—	—
apache	http_server	—	—
apache	http_server	—	—
apache	http_server	—	—
apache	http_server	—	—
apache	http_server	—	—
apache	http_server	—	—
apache	http_server	—	—
apache	http_server	—	—
apache	http_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://www.example.com/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini↗

url http://www.example.com/..%5C..%5C..%5C..%5C..%5C..%5C/boot.ini↗

path ..%5C↗

• → Detect HTTP requests containing URL-encoded backslash-dot-dot sequences ('%5c%2e%2e' or '..%5C') in the request URI, indicative of directory traversal attempts against Apache on Cygwin. ↗
• → Look for requests targeting sensitive Windows files (e.g., boot.ini) via traversal sequences, as the exploit specifically demonstrates reading Windows system files through the traversal. ↗
• → Flag HTTP requests using double-encoded traversal patterns combining '%5c' (backslash) and '%2e%2e' (dot dot) in sequence, as both encoding variants are used in exploitation. ↗

• · This vulnerability is exclusively present on Apache instances running on Cygwin (Windows emulation layer); detection rules should be scoped or prioritized accordingly to reduce false positives on non-Cygwin deployments. ↗
• · Affected versions are Apache 1.3.29 and earlier, and Apache 2.0.48 and earlier; detections are only relevant against these legacy version ranges on Cygwin. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.