Apache HTTP Server 2.4.49 and 2.4.50 contain path traversal vulnerabilities…

7 October 2021 critical vulnerability

Apache HTTP Server 2.4.49 and 2.4.50 contain path traversal vulnerabilities (CVE-2021-41773, CVE-2021-42013) enabling remote file access; active exploitation observed in Japan.

Japan's IPA (Information-technology Promotion Agency) issued an urgent security alert regarding critical path traversal vulnerabilities in Apache HTTP Server. The advisory confirms active exploitation of CVE-2021-41773 affecting version 2.4.49, with attacks observed within Japan. Apache initially released version 2.4.50 to address CVE-2021-41773, but the patch was deemed insufficient, leading to the assignment of CVE-2021-42013. Version 2.4.51 was subsequently released to fully remediate both vulnerabilities.

The vulnerabilities allow remote attackers to perform path traversal attacks and access files outside the document root. IPA warns that damage is likely to expand and urges immediate patching. The advisory was updated multiple times between October 6-8, 2021, reflecting the evolving threat landscape as domestic attacks were confirmed and the incomplete nature of the initial patch became apparent.

Organizations running affected Apache HTTP Server versions should prioritize upgrading to version 2.4.51 or later. The confirmation of in-the-wild exploitation, particularly within Japan, elevates the urgency of this remediation effort.

Mentioned in this report

Vulnerabilities CVE-2021-41773KEVCVE-2021-42013KEV

Detection guidance

Apache HTTP Server Path Traversal Exploit Attempt (CVE-2021-41773/CVE-2021-42013)

ATT&CK T1190

Detects HTTP requests containing encoded path traversal sequences targeting cgi-bin or similar aliased directories, indicative of CVE-2021-41773/CVE-2021-42013 exploitation against Apache HTTP Server 2.4.49/2.4.50. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Apache HTTP Server Path Traversal Exploit Attempt
id: c9dc9b97-508e-5403-ada2-e8450327626c
status: experimental
logsource:
  category: webserver
  product: apache
detection:
  selection_path:
    cs-uri-query|contains:
    - /cgi-bin/
    - /icons/
  selection_traversal:
    cs-uri-query|contains:
    - '%2e%2e/'
    - '%2e%2e%2f'
    - ..%2f
    - '%252e%252e%252f'
    - '%%32%65%%32%65%%32%66'
  filter:
    cs-uri-query|contains:
    - /cgi-bin/printenv
    - /cgi-bin/test-cgi
  condition: selection_path and selection_traversal and not filter
falsepositives:
- Security scanning tools deliberately testing for the vulnerability
- Legitimate CGI scripts that pass encoded relative paths as query parameters
level: high
tags:
- attack.t1190
- cve.2021-41773
- cve.2021-42013
author: Vorant

Shell Spawned from Apache HTTP Server Worker Process (Possible mod_cgi RCE)

ATT&CK T1190

Detects a shell or command interpreter being spawned as a child of the Apache httpd process, consistent with remote code execution following successful path traversal exploitation via cgi-bin (CVE-2021-41773/CVE-2021-42013). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Shell Spawned from Apache HTTP Server Worker Process
id: 0375e2a7-fff5-5611-a1ce-30d5cc0db549
status: experimental
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /httpd
    - /apache2
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /cat
    - /id
    - /whoami
    - /curl
    - /wget
    - /python
    - /perl
  condition: selection_parent and selection_child
falsepositives:
- Legitimate CGI scripts that intentionally invoke shell utilities as part of normal
  application logic
- Server health-check or monitoring scripts executed via mod_cgi
level: high
tags:
- attack.t1190
- attack.t1059
- cve.2021-41773
- cve.2021-42013
author: Vorant

Apache Worker Process Accessing Sensitive System Files Outside Web Root

ATT&CK T1083

Detects the Apache httpd/apache2 process opening or reading sensitive system files such as /etc/passwd or /etc/shadow, indicating successful path traversal enabling access to files outside the document root. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Apache Worker Process Accessing Sensitive System Files
id: b71198c5-3a44-5f8d-9186-bbe41c7f043e
status: experimental
logsource:
  category: file_event
  product: linux
detection:
  selection:
    Image|endswith:
    - /httpd
    - /apache2
    TargetFilename|contains:
    - /etc/passwd
    - /etc/shadow
    - /etc/hosts
    - /etc/apache2/
    - /etc/httpd/
  condition: selection
falsepositives:
- Configuration reload or startup routines that legitimately read /etc/hosts or Apache
  configuration files
level: medium
tags:
- attack.t1083
- attack.t1190
- cve.2021-41773
- cve.2021-42013
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/alert20211006.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free