CVE-2021-41773: Path Traversal & RCE in Apache HTTP Server | Qualys
Summary: On October 4, 2021, the Apache HTTP Server Project issued an advisory for CVE-2021-41773, a path traversal and file disclosure flaw in versions 2.4.49 and 2.4.50 that Apache said was known to be exploited in the wild, and research later showed it could be chained to remote code execution. The bug came from inadequate path normalization that failed to decode an encoded second dot (as %2e, and later double-encoded as %%32%65 in 2.4.50, tracked as CVE-2021-42013), and exploitation required a non-default configuration where the filesystem directory directive was set to Require all granted or was missing entirely.
Key Takeaway: Checking the Apache version alone does not identify vulnerable servers, because the flaw only bites when the directory directive is misconfigured and, for RCE, when mod_cgi is enabled - so a version scan can clear a host that is actually exploitable.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-41773CVE-2021-42013
- Related
- Attackers Move Quickly to Exploit High-Profile Zero Days: Insights From the 2022 Unit 42 Incident Response Report Cyber Risks ·CVE-2021-41773: Apache HTTP Server Path Traversal Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2021-42013: Apache HTTP Server Path Traversal Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021