# CVE-2021-41773: Apache HTTP Server - Path Traversal

> Live exploitation tracking for CVE-2021-41773 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-41773

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** Apache HTTP Server
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** web_server, c

## Description

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

## CrowdSec analysis

[CVE-2021-41773](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-41773) is a vulnerability in the Apache HTTP Server that allows attackers to carry out path traversal attacks, potentially enabling access to files outside of intended directories. If CGI scripts are present and enabled, exploitation could lead to remote code execution.

CrowdSec has been tracking this vulnerability and its exploits since 11th of October 2021.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2021-41773 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2021-41773 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2021-41773 is currently experiencing high visibility and active exploitation across the internet.

Attackers are observed probing for URL patterns containing `/icons/.%2e/` or `/cgi-bin/.%2e/` to exploit path traversal weaknesses.

## Timeline

- 2021-10-05: CVE Published. CVE-2021-41773 is published to NVD.
- 2021-10-11: Rule Released. CrowdSec releases a rule to detect CVE-2021-41773 exploitation attempts against the CrowdSec Network.
- 2021-10-11: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-41773 for the first time.
- 2021-11-03: CISA KEV. CVE-2021-41773 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2021-11-17: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://httpd.apache.org/security/vulnerabilities_24.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://security.netapp.com/advisory/ntap-20211029-0009/
- https://security.gentoo.org/glsa/202208-20
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41773.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-41773) follows observed exploitation activity for CVE-2021-41773. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.