CRITICAL

CVE-2021-42013

Apache HTTP Server 2021-10-07 CVSS v3.1

CVSS

9.8

KEV

Description

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Summary dbcve.org

Apache HTTP Server 2.4.50 contains an incomplete fix for CVE-2021-41773, allowing attackers to use path traversal sequences (such as %2e%2e/) to map URLs to files outside directories configured by Alias-like directives. If these files are not protected by 'require all denied', the requests succeed. When CGI scripts are enabled for aliased paths, this enables remote code execution.

Mitigation

Upgrade Apache HTTP Server to version 2.4.51 or later, or ensure all directories outside Alias directives are protected with 'require all denied' and CGI scripts are disabled for those paths.

Proof of Concept

Weakness (CWE)

CWE-22 Path Traversal

EPSS Score

99.96%

Probability of exploitation in next 30 days

100th percentile

References

http://jvn.jp/en/jp/JVN51106450/index.html Third Party Advisory http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry http://www.openwall.com/lists/oss-security/2021/10/07/6 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/08/1 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/08/2 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/08/3 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/08/4 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/08/5 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/08/6 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/09/1 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/11/4 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/15/3 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/10/16/1 Mailing List, Third Party Advisory https://httpd.apache.org/security/vulnerabilities_24.html Release Notes, Vendor Advisory https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E Mailing List, Patch https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E Mailing List https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/ Release Notes https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/ Release Notes https://security.gentoo.org/glsa/202208-20 Third Party Advisory https://security.netapp.com/advisory/ntap-20211029-0009/ Third Party Advisory https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ Third Party Advisory https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory https://www.povilaika.com/apache-2-4-50-exploit/ Exploit, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42013 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.