Threat Advisory: Apache HTTP Server zero-day vulnerability opens door for attackers
Summary: Cisco Talos reports that CVE-2021-41733, a path traversal and file disclosure flaw introduced in Apache HTTP Server 2.4.49, is being actively exploited in the wild, and that the fix in 2.4.50 was insufficient, leading to a second vulnerability, CVE-2021-42013, with 2.4.51 released to fully address both. Shodan data cited by Talos indicates less than 1 percent of the Apache install base runs 2.4.49 or 2.4.50, and after deploying Snort rule 58276 Talos saw exploitation activity from a variety of addresses, mostly targeting /etc/passwd and /bin/sh with cURL as the predominant user agent.
Bottom line: Talos describes the exploit as very low complexity and easily automated, and the activity it observed spans wide-scale scanners, actors iterating through large lists of domains, and a lower-volume group keenly interested in this specific vulnerability - so a small affected population is not the same as a small risk.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2021-41733CVE-2021-42013
- Related
- Threat Source newsletter (Oct. 14, 2021) Cyber Risks ·Threat Source newsletter (Oct. 28, 2021) Cyber Risks ·