CRITICAL

CVE-2021-41773

Apache HTTP Server 2021-10-05 CVSS v3.1

CVSS

9.8

KEV

Description

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

Summary dbcve.org

A path traversal vulnerability in Apache HTTP Server 2.4.49's path normalization allows attackers to use specially crafted URL paths with directory traversal sequences (e.g., /icons/.%2e/) to access files outside directories configured by Alias-like directives. If the default protection 'require all denied' is missing and CGI scripts are enabled for these aliased paths, arbitrary code execution becomes possible.

Mitigation

Upgrade to Apache HTTP Server 2.4.50 or later. Alternatively, ensure all directories outside DocumentRoot are protected with 'Require all denied' and disable CGI scripts for aliased paths until patching is possible.

Proof of Concept

Weakness (CWE)

CWE-22 Path Traversal

EPSS Score

99.99%

Probability of exploitation in next 30 days

100th percentile

References

http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry http://www.openwall.com/lists/oss-security/2021/10/05/2 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/07/1 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/07/6 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/08/1 Exploit, Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/08/2 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/08/3 Exploit, Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/08/4 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/08/5 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/08/6 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/09/1 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/11/4 Mailing List, Patch, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/15/3 Mailing List, Patch, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/16/1 Mailing List, Third Party Advisory https://httpd.apache.org/security/vulnerabilities_24.html Release Notes, Vendor Advisory https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E Mailing List, Patch https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.httpd.apache.org%3E Mailing List https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E Mailing List https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E Mailing List https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/ Release Notes https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/ Release Notes https://security.gentoo.org/glsa/202208-20 Third Party Advisory https://security.netapp.com/advisory/ntap-20211029-0009/ Third Party Advisory https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ Third Party Advisory https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.