Apache HTTP Server path traversal flaws enable remote file access
Apache HTTP Server 2.4.49 and 2.4.50 contain path traversal vulnerabilities (CVE-2021-41773, CVE-2021-42013) enabling remote file access; active exploitation observed in Japan.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2021-41773 and CVE-2021-42013 as exploited in the wild.
Japan's IPA (Information-technology Promotion Agency) issued an urgent security alert regarding critical path traversal vulnerabilities in Apache HTTP Server. The advisory confirms active exploitation of CVE-2021-41773 affecting version 2.4.49, with attacks observed within Japan. Apache initially released version 2.4.50 to address CVE-2021-41773, but the patch was deemed insufficient, leading to the assignment of CVE-2021-42013. Version 2.4.51 was subsequently released to fully remediate both vulnerabilities.
The vulnerabilities allow remote attackers to perform path traversal attacks and access files outside the document root. IPA warns that damage is likely to expand and urges immediate patching. The advisory was updated multiple times between October 6-8, 2021, reflecting the evolving threat landscape as domestic attacks were confirmed and the incomplete nature of the initial patch became apparent.
Organizations running affected Apache HTTP Server versions should prioritize upgrading to version 2.4.51 or later. The confirmation of in-the-wild exploitation, particularly within Japan, elevates the urgency of this remediation effort.
Mentioned in this report
Detection guidance
Apache HTTP Server Path Traversal Exploit Attempt (CVE-2021-41773/CVE-2021-42013)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests containing encoded path traversal sequences targeting cgi-bin or similar aliased directories, indicative of CVE-2021-41773/CVE-2021-42013 exploitation against Apache HTTP Server 2.4.49/2.4.50. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Apache HTTP Server Path Traversal Exploit Attempt
id: c9dc9b97-508e-5403-ada2-e8450327626c
status: experimental
logsource:
category: webserver
detection:
selection_path:
cs-uri-query|contains:
- /cgi-bin/
- /icons/
selection_traversal:
cs-uri-query|contains:
- '%2e%2e/'
- '%2e%2e%2f'
- ..%2f
- '%252e%252e%252f'
- '%%32%65%%32%65%%32%66'
filter:
cs-uri-query|contains:
- /cgi-bin/printenv
- /cgi-bin/test-cgi
condition: selection_path and selection_traversal and not filter
falsepositives:
- Security scanning tools deliberately testing for the vulnerability
- Legitimate CGI scripts that pass encoded relative paths as query parameters
level: high
tags:
- attack.t1190
- cve.2021-41773
- cve.2021-42013
author: Vorant
Shell Spawned from Apache HTTP Server Worker Process (Possible mod_cgi RCE)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell or command interpreter being spawned as a child of the Apache httpd process, consistent with remote code execution following successful path traversal exploitation via cgi-bin (CVE-2021-41773/CVE-2021-42013). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Spawned from Apache HTTP Server Worker Process
id: 0375e2a7-fff5-5611-a1ce-30d5cc0db549
status: experimental
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /httpd
- /apache2
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /cat
- /id
- /whoami
- /curl
- /wget
- /python
- /perl
condition: selection_parent and selection_child
falsepositives:
- Legitimate CGI scripts that intentionally invoke shell utilities as part of normal
application logic
- Server health-check or monitoring scripts executed via mod_cgi
level: high
tags:
- attack.t1190
- attack.t1059
- cve.2021-41773
- cve.2021-42013
author: Vorant
Apache Worker Process Accessing Sensitive System Files Outside Web Root
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the Apache httpd/apache2 process opening or reading sensitive system files such as /etc/passwd or /etc/shadow, indicating successful path traversal enabling access to files outside the document root. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Apache Worker Process Accessing Sensitive System Files
id: b71198c5-3a44-5f8d-9186-bbe41c7f043e
status: experimental
logsource:
category: file_event
product: linux
detection:
selection:
Image|endswith:
- /httpd
- /apache2
TargetFilename|contains:
- /etc/passwd
- /etc/shadow
- /etc/hosts
- /etc/apache2/
- /etc/httpd/
condition: selection
falsepositives:
- Configuration reload or startup routines that legitimately read /etc/hosts or Apache
configuration files
level: medium
tags:
- attack.t1083
- attack.t1190
- cve.2021-41773
- cve.2021-42013
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/alert20211006.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs