Path Traversal and Remote Code Execution in Apache HTTP Server (CVE-2021-41773) | Cybersecurity Blog | Grey Noise
Summary: Apache disclosed CVE-2021-41773 on October 4th, 2021, a path traversal flaw introduced in HTTP Server 2.4.49 and patched in 2.4.50 that lets crafted requests read files outside the document root, including configuration files and CGI scripts, and achieve remote code execution where mod_cgi is enabled. GreyNoise observed the first scan from 36.68.53.196 on October 3rd at 08:44 UTC, before Apache's October 5th mailing list announcement and the 2.4.50 release, but after the patch was committed on September 29th; as of October 7th, GreyNoise had seen 47 unique scanning IP addresses, 39 malicious and 8 benign.
What you should know: The first scan landed before the public announcement and before the patched release shipped, so the window between a committed fix and a disclosed vulnerability is one attackers already work in. Of the 47 IPs GreyNoise counted, 39 were classified malicious.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-41773
- Related
- CVE-2021-41773: Apache HTTP Server Path Traversal Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021