Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
Apache HTTP Server 2.4.49 can map URLs to files outside its configured directories. The risk of code execution applies when CGI scripts are enabled on aliased paths. The 2.4.50 fix was found insufficient.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Apache HTTP Server 2.4.49 is affected, allowing attackers to use path traversal to read files outside the directories set up for URL aliases, and potentially run code remotely if CGI scripts are enabled for those aliased paths.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Apache Software Foundation Apache HTTP Server
Apache HTTP Server 2.4 2.4.49
References 25
httpd.apache.org
lists.apache.org
- thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@<users.httpd.apache.org>
- thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@<announce.apache.org>
- thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@<announce.apache.org>
- thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@<users.httpd.apache.org>
- thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@<cvs.httpd.apache.org>
openwall.com
- lists/oss-security/2021/10/05/2
- lists/oss-security/2021/10/07/1
- lists/oss-security/2021/10/07/6
- lists/oss-security/2021/10/08/1
- lists/oss-security/2021/10/08/2
- lists/oss-security/2021/10/08/3
- lists/oss-security/2021/10/08/4
- lists/oss-security/2021/10/08/6
- lists/oss-security/2021/10/08/5
- lists/oss-security/2021/10/09/1
- lists/oss-security/2021/10/11/4
- lists/oss-security/2021/10/15/3
- lists/oss-security/2021/10/16/1
packetstormsecurity.com
lists.fedoraproject.org
oracle.com
Questions about CVE-2021-41773
What does this mean?
A path traversal flaw lets request URLs reach files outside the configured directories. If CGI scripts are also enabled for those aliased paths, this could allow remote code execution.Source: lists.fedoraproject.org
Am I affected, and how do I check?
The advisory title names Apache HTTP Server 2.4.49. Files outside Alias-like directories are not protected where the usual default configuration "require all denied" is not in place, and the code execution risk needs CGI scripts enabled on aliased paths. Check the installed version with httpd -v and review Alias and ScriptAlias settings in the configuration.Source: lists.fedoraproject.org
What should I do about it?
The checked facts do not name a fixed version. The fix in 2.4.50 was found insufficient, so 2.4.50 should not be treated as a complete fix.Source: lists.fedoraproject.org
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
The checked facts list no workaround. Limiting exposure means disabling CGI scripts on aliased paths and keeping the default "require all denied" protection in place for directories outside the Alias-like paths.Source: lists.fedoraproject.org
Is the fix complete?
The advisory says the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient, so the fix is only partial.Source: lists.fedoraproject.org