CVE-2021-42013 Apache HTTP Server Path Traversal
Attackers can exploit path traversal to read arbitrary files or execute code if CGI is enabled and default protections are bypassed.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-42013?
CVE-2021-42013 is a critical path traversal vulnerability in Apache Http Server, published on 7 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
Weakness: CWE-22
Which versions are affected by CVE-2021-42013?
1 open source package ship an affected version, including apache. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.49 | 2.4.50, 2.4.51 |
Products include Apache Http Server, Fedoraproject Fedora, Netapp Cloud Backup, Oracle Instantis Enterprisetrack, Oracle Jd Edwards Enterpriseone Tools, Oracle Secure Backup.
How do I fix CVE-2021-42013?
Upgrade apache to a fixed version for your release line: 2.4.50 or 2.4.51. US federal agencies must fix it by 17 Nov 2021.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-42013 being exploited?
Yes. Attackers have exploited CVE-2021-42013 in the wild since at least 3 Nov 2021, including in ransomware campaigns.
Public exploit code: 2 Metasploit modules, 3 Exploit-DB entries, 1 Nuclei template and 37 proofs of concept on GitHub.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2021-42013, BIT-apache-2021-42013, CLEANSTART-2026-XG20648, DEBIAN-CVE-2021-42013, GHSA-m24x-wx9p-jqmh, MGASA-2021-0470.