Patchfirst
Patchfirst
CVE-2021-42013 KEVRansomwarePublic exploit Critical · 9.8 EPSS >99.9%

Apache HTTP Server Path Traversal Vulnerability

Apache · HTTP Server

Summary

The flaw is a path traversal weakness in the HTTP Server product from Apache, in its URL-to-file mapping handling for Alias-like directives, where an incomplete fix for an earlier issue left it open. An unauthenticated remote attacker who can send requests to the server can use crafted paths to reach files outside the configured directories, which can lead to remote code execution if CGI scripts are enabled for those aliased paths and the default "require all denied" protection is not in place for the affected files.

Official description · NVD

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Breakdown
83.7 / 100
Exploited
Yes, in CISA KEV
Reports
1
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 27 days after disclosure. Public exploit code (Metasploit) was available 5 months before disclosure.

  1. Public exploit codeMetasploit5 mo before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidenceAdded to CISA KEVknown ransomware use; EU database agrees+27 days

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

A fix was bypassed or incomplete once over 2 days.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2021-41773HTTP Server Path Traversal5 Oct 2021KEV
  2. incomplete fixHigh

    Why these are linked:

    • Stated in the CVE textIt was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient.
    • Similar weakness in the same product (machine-matched)same product + CWE + description similarity
    This CVECVE-2021-42013HTTP Server Path Traversal7 Oct 2021KEV

techniques

2 , grouped by in kill-chain order, 3 cited passages 2

ExecutionTA0002

Command and Scripting Interpreter T1059
MITRE CTID mapping of the KEV entry · primary impact

CVE-2021-42013 was introduced as the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50. CVE-2021-42013 is a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows an attacker to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied," these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution.

Lateral MovementTA0008

Exploitation of Remote Services T1210
MITRE CTID mapping of the KEV entry · how it is exploited
Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

  • Exploit Public-Facing ApplicationT1190 machine-matched from report text

Detection

0 rules for this CVE · 110 general rules for its techniques

Rules for this CVE

0 that reference CVE-2021-42013 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploitation of Remote ServicesT121015 general rules
All 15 on SigmaHQ ↗
Command and Scripting InterpreterT105995 general rules
All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report
1 reportMicrosoft

Reports are matched by finding the exact id CVE-2021-42013 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

MicrosoftUndated

Microsoft research uncovers new Zerobot capabilities

Microsoft researchers have also identified that previous reports have used the vulnerability ID “ZERO-32906” for CVE-2018-20057, “GPON” for CVE-2018-10561, and “DLINK” for CVE-2016-20017; and that CVE-2020-7209 was mislabeled as CVE-2017-17106 and CVE-2022-42013 was mislabeled as CVE-2021-42013.

3 passages name itOriginal (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

31 links, grouped by NVD tag (30 duplicates merged)

Vendor Advisory 1

httpd.apache.org/security/vulnerabilities_24.html

Patch 3

lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3Eoracle.com/security-alerts/cpuapr2022.htmloracle.com/security-alerts/cpujan2022.html

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42013

Third Party Advisory 22

jvn.jp/en/jp/JVN51106450/index.htmlpacketstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.htmlpacketstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.htmlpacketstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.htmlpacketstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.htmlpacketstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.htmlpacketstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.htmlopenwall.com/lists/oss-security/2021/10/07/6
Show 14 moreShow feweropenwall.com/lists/oss-security/2021/10/08/1openwall.com/lists/oss-security/2021/10/08/2openwall.com/lists/oss-security/2021/10/08/3openwall.com/lists/oss-security/2021/10/08/4openwall.com/lists/oss-security/2021/10/08/5openwall.com/lists/oss-security/2021/10/08/6openwall.com/lists/oss-security/2021/10/09/1openwall.com/lists/oss-security/2021/10/11/4openwall.com/lists/oss-security/2021/10/15/3openwall.com/lists/oss-security/2021/10/16/1security.gentoo.org/glsa/202208-20security.netapp.com/advisory/ntap-20211029-0009/tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZpovilaika.com/apache-2-4-50-exploit/

Release Notes 2

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/

Mailing List 2

lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3Elists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E
↑ ↓ chooseEnter openEsc close