// For flags

CVE-2021-42013

Apache HTTP Server Path Traversal Vulnerability

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

28
*Multiple Sources

Exploited in Wild

Yes
*KEV

Decision

-
*SSVC
Descriptions

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Se ha detectado que la corrección de CVE-2021-41773 en Apache HTTP Server versión 2.4.50 no era suficiente. Un atacante podía usar un ataque de salto de ruta para asignar URLs a archivos fuera de los directorios configurados por las directivas tipo Alias. Si los archivos fuera de estos directorios no están protegidos por la configuración habitual por defecto "require all denied", estas peticiones pueden tener éxito. Si los scripts CGI también están habilitados para estas rutas alias, esto podría permitir una ejecución de código remota . Este problema sólo afecta a Apache versión 2.4.49 y Apache versión 2.4.50 y no a versiones anteriores

Apache HTTP Server version 2.4.50 suffers from path traversal and code execution vulnerabilities.

Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.

*Credits: Reported by Juan Escobar from Dreamlab Technologies, Fernando Muñoz from NULL Life CTF Team, and Shungo Kumasaka
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-10-06 CVE Reserved
  • 2021-10-07 CVE Published
  • 2021-10-08 First Exploit
  • 2021-11-03 Exploited in Wild
  • 2021-11-17 KEV Due Date
  • 2024-08-04 CVE Updated
  • 2024-11-09 EPSS Updated
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (56)
URL Tag Source
http://jvn.jp/en/jp/JVN51106450/index.html Third Party Advisory
http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/07/6 Mailing List
http://www.openwall.com/lists/oss-security/2021/10/08/1 Mailing List
http://www.openwall.com/lists/oss-security/2021/10/08/2 Mailing List
http://www.openwall.com/lists/oss-security/2021/10/08/3 Mailing List
http://www.openwall.com/lists/oss-security/2021/10/08/4 Mailing List
http://www.openwall.com/lists/oss-security/2021/10/08/5 Mailing List
http://www.openwall.com/lists/oss-security/2021/10/08/6 Mailing List
http://www.openwall.com/lists/oss-security/2021/10/09/1 Mailing List
http://www.openwall.com/lists/oss-security/2021/10/11/4 Mailing List
http://www.openwall.com/lists/oss-security/2021/10/15/3 Mailing List
http://www.openwall.com/lists/oss-security/2021/10/16/1 Mailing List
https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E Mailing List
https://security.netapp.com/advisory/ntap-20211029-0009 Third Party Advisory
https://github.com/RootUp/PersonalStuff/blob/master/http-vuln-cve-2021-41773.nse
https://github.com/projectdiscovery/nuclei-templates/blob/master/vulnerabilities/apache/apache-httpd-rce.yaml
https://github.com/projectdiscovery/nuclei-templates/commit/9384dd235ec5107f423d930ac80055f2ce2bff74
https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773/rapid7-analysis
URL Date SRC
https://www.exploit-db.com/exploits/50406 2021-10-13
https://www.exploit-db.com/exploits/50446 2021-10-25
https://www.exploit-db.com/exploits/50512 2021-11-11
https://github.com/andrea-mattioli/apache-exploit-CVE-2021-42013 2021-10-08
https://github.com/asaotomo/CVE-2021-42013-Apache-RCE-Poc-Exp 2021-12-24
https://github.com/BassoNicolas/CVE-2021-42013 2024-04-07
https://github.com/TheLastVvV/CVE-2021-42013 2021-10-23
https://github.com/rafifdna/CVE-2021-42013 2024-06-27
https://github.com/rnsss/CVE-2021-42013 2022-01-07
https://github.com/LayarKacaSiber/CVE-2021-42013 2021-10-23
https://github.com/birdlinux/CVE-2021-42013 2023-06-26
https://github.com/mauricelambert/CVE-2021-42013 2022-03-14
https://github.com/robotsense1337/CVE-2021-42013 2021-11-03
https://github.com/12345qwert123456/CVE-2021-42013 2022-11-18
https://github.com/imhunterand/CVE-2021-42013 2024-01-07
https://github.com/Hamesawian/CVE-2021-42013 2023-06-29
https://github.com/vudala/CVE-2021-42013 2023-06-22
https://github.com/honypot/CVE-2021-42013 2022-02-19
https://github.com/jas9reet/CVE-2021-42013-LAB 2022-06-06
https://github.com/K3ysTr0K3R/CVE-2021-42013-EXPLOIT 2024-01-15
https://github.com/xMohamed0/CVE-2021-42013-ApacheRCE 2021-11-14
https://github.com/pisut4152/Sigma-Rule-for-CVE-2021-41773-and-CVE-2021-42013-exploitation-attempt 2021-10-08
http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html 2024-08-04
http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html 2024-08-04
http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html 2024-08-04
http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html 2024-08-04
http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html 2024-08-04
https://www.povilaika.com/apache-2-4-50-exploit 2024-08-04
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
Http Server
Search vendor "Apache" for product "Http Server"
2.4.49
Search vendor "Apache" for product "Http Server" and version "2.4.49"
-
Affected
Apache
Search vendor "Apache"
Http Server
Search vendor "Apache" for product "Http Server"
2.4.50
Search vendor "Apache" for product "Http Server" and version "2.4.50"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
34
Search vendor "Fedoraproject" for product "Fedora" and version "34"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
35
Search vendor "Fedoraproject" for product "Fedora" and version "35"
-
Affected
Oracle
Search vendor "Oracle"
Instantis Enterprisetrack
Search vendor "Oracle" for product "Instantis Enterprisetrack"
17.1
Search vendor "Oracle" for product "Instantis Enterprisetrack" and version "17.1"
-
Affected
Oracle
Search vendor "Oracle"
Instantis Enterprisetrack
Search vendor "Oracle" for product "Instantis Enterprisetrack"
17.2
Search vendor "Oracle" for product "Instantis Enterprisetrack" and version "17.2"
-
Affected
Oracle
Search vendor "Oracle"
Instantis Enterprisetrack
Search vendor "Oracle" for product "Instantis Enterprisetrack"
17.3
Search vendor "Oracle" for product "Instantis Enterprisetrack" and version "17.3"
-
Affected
Oracle
Search vendor "Oracle"
Jd Edwards Enterpriseone Tools
Search vendor "Oracle" for product "Jd Edwards Enterpriseone Tools"
< 9.2.6.0
Search vendor "Oracle" for product "Jd Edwards Enterpriseone Tools" and version " < 9.2.6.0"
-
Affected
Oracle
Search vendor "Oracle"
Secure Backup
Search vendor "Oracle" for product "Secure Backup"
< 18.1.0.1.0
Search vendor "Oracle" for product "Secure Backup" and version " < 18.1.0.1.0"
-
Affected
Netapp
Search vendor "Netapp"
Cloud Backup
Search vendor "Netapp" for product "Cloud Backup"
--
Affected