⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2021-11-17.

CVE-2021-41773 — Path Traversal in Software Foundation Apache Http Server

CWE-22 — Path Traversal38 documents26 sources
Severity
9.8CRITICALNVD
EPSS
94.4%
top 0.03%
CISA KEV
KEVRansomware
Added 2021-11-03
Due 2021-11-17
Exploit
Exploited in wild
Active exploitation observed
Affected products
5
Apache Software Foundation Apache Http ServerApache Http ServerFedoraproject Fedora+2 more
Timeline
PublishedOct 5
KEV addedNov 3
KEV dueNov 17
Latest updateSep 4
CISA Required Action: Apply updates per vendor instructions.

Description

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5apache_software_foundation/apache_http_serverApache HTTP Server 2.4 2.4.49, Apache HTTP Server 2.4.49, Apache HTTP Server 2.4.50+2
▶NVDapache/http_server2.4.49
▶Palo Altopaloalto/pan-os
▶NVDoracle/instantis_enterprisetrack17.1, 17.2, 17.3+2

Also affects: Fedora 34, 35

Patches

Patch: www.openwall.com ↗Patch: www.openwall.com ↗Patch: lists.apache.org ↗

🔴Vulnerability Details

5
GHSA
GHSA-29h7-gr57-5f8r: A flaw was found in a change made to path normalization in Apache HTTP Server 2↗2022-05-24
▶
Project0
The More You Know, The More You Know You Don’t Know - Project Zero↗2022-04-01
▶
OSV
CVE-2021-41773: A flaw was found in a change made to path normalization in Apache HTTP Server 2↗2021-10-05
▶
CVEList
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49↗2021-10-05
▶
VulnCheck
Apache HTTP Server Path Traversal Vulnerability↗2021
▶

💥Exploits & PoCs

5
Exploit-DB
Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)↗2021-11-11
▶
Exploit-DB
Apache HTTP Server 2.4.49 - Path Traversal & Remote Code Execution (RCE)↗2021-10-06
▶
Metasploit
Apache 2.4.49/2.4.50 Traversal RCE↗
▶
Nuclei
Apache 2.4.49 - Path Traversal and Remote Code Execution
▶
Metasploit
Apache 2.4.49/2.4.50 Traversal RCE scanner↗
▶

🔍Detection Rules

4
Suricata
ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M3↗2021-10-06
▶
Suricata
ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M1↗2021-10-05
▶
Suricata
ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2↗2021-10-05
▶
Suricata
ET INFO Apache HTTP Server 2.4.49 Observed - Vulnerable to CVE-2021-41773↗2021-10-05
▶

📋Vendor Advisories

7
Palo Alto
PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS↗2024-09-04
▶
CISA
Apache HTTP Server Path Traversal Vulnerability↗2021-11-03
▶
Microsoft
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49↗2021-10-12
▶
Cisco
Apache HTTP Server Vulnerabilities: October 2021↗2021-10-07
▶
Red Hat
httpd: path traversal and file disclosure vulnerability↗2021-09-29
▶

🕵️Threat Intelligence

10
Unit42
Network Security Trends: August-October 2021↗2021-12-21
▶
Trendmicro
Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify↗2021-12-03
▶
Trendmicro
Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify↗2021-12-03
▶
Trendmicro
Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify↗2021-12-03
▶
Trendmicro
Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify↗2021-12-03
▶

💬Community

2
HackerOne
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)↗2021-11-19
▶
HackerOne
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.50↗2021-11-19
▶
CVE-2021-41773 — Path Traversal | cvebase