CVE-2021-41773 Apache HTTP Server Path Traversal
Attackers can exploit path traversal to read files outside web directories or execute code if CGI is enabled, affecting Apache HTTP Server.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41773?
CVE-2021-41773 is a high-severity path traversal vulnerability in Apache Http Server, published on 5 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
Weakness: CWE-22
Which versions are affected by CVE-2021-41773?
1 open source package ship an affected version, including apache. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.49 | 2.4.50 |
Products include Apache Http Server, Fedoraproject Fedora, Netapp Cloud Backup, Oracle Instantis Enterprisetrack.
How do I fix CVE-2021-41773?
Upgrade apache to 2.4.50 or later. US federal agencies must fix it by 17 Nov 2021.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-41773 being exploited?
Yes. Attackers have exploited CVE-2021-41773 in the wild since at least 3 Nov 2021, including in ransomware campaigns.
Public exploit code: 2 Metasploit modules, 2 Exploit-DB entries, 1 Nuclei template and 175 proofs of concept on GitHub.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2021-41773, BIT-apache-2021-41773, CLEANSTART-2026-ZP32525, DEBIAN-CVE-2021-41773, GHSA-29h7-gr57-5f8r.