CrowdSecLive Exploit Tracker
Background NoiseCVE-2021-41773Public Exploit

Apache HTTP Server - Path Traversal (CVE-2021-41773)

PublishedOct 5, 2021
First SeenOct 11, 2021
Last Seen
Reported
CVSS7.5
Apache
ApacheApache HTTP Server
web_serverc

Description

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

psychologyCrowdSec Analysis

CVE-2021-41773 is a vulnerability in the Apache HTTP Server that allows attackers to carry out path traversal attacks, potentially enabling access to files outside of intended directories. If CGI scripts are present and enabled, exploitation could lead to remote code execution.

CrowdSec has been tracking this vulnerability and its exploits since 11th of October 2021.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2021-41773 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2021-41773 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2021-41773 is currently experiencing high visibility and active exploitation across the internet.

Attackers are observed probing for URL patterns containing /icons/.%2e/ or /cgi-bin/.%2e/ to exploit path traversal weaknesses.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2021-10-05
Rule Released2021-10-11
CrowdSec First Seen2021-10-11
CISA KEV2021-11-03
CISA Remediation Deadline2021-11-17

Related Weaknesses

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References