Apache HTTP Server path traversal exploited in Japan
Attackers are actively exploiting a path traversal flaw in Apache HTTP Server (CVE-2021-41773), with an incomplete fix leading to a second CVE (CVE-2021-42013).
The Information-technology Promotion Agency (IPA) Japan issued an alert regarding a path traversal and file disclosure vulnerability in Apache HTTP Server, tracked as CVE-2021-41773. The flaw allows remote attackers to access files outside the intended document root, potentially leading to source code disclosure or, in certain configurations, remote code execution via CGI scripts. IPA confirmed that attacks exploiting this vulnerability have been observed within Japan, prompting an urgent call for organizations to patch immediately.
The initial fix released in Apache HTTP Server version 2.4.50 was later found to be incomplete, resulting in a second vulnerability, CVE-2021-42013, which shares the same root cause and attack vector. The Apache Software Foundation subsequently released version 2.4.51 to fully address both issues. IPA updated its advisory to reflect this development and urged administrators to apply the latest patch rather than relying on the earlier partial fix.
Given the active exploitation observed in the wild and the widespread deployment of Apache HTTP Server, this represents a significant and urgent patching priority for any organization running affected versions, particularly those exposing Apache servers to the internet.
Mentioned in this report
Detection guidance
Apache Path Traversal Exploitation Attempt (CVE-2021-41773/CVE-2021-42013)
Detects HTTP requests containing the encoded path traversal sequence used to escape the Apache document root via /cgi-bin/ or /icons/ aliases. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Apache Path Traversal Exploitation Attempt (CVE-2021-41773/CVE-2021-42013)
id: 16a5d5e2-4906-57d5-ac10-b8c4302b9265
status: experimental
description: 'Detects HTTP requests exploiting CVE-2021-41773 and CVE-2021-42013,
Apache HTTP Server path traversal vulnerabilities that allow access to files outside
the document root via encoded ''../'' sequences targeting aliased paths such as
/cgi-bin/ or /icons/.
'
references:
- https://httpd.apache.org/security/vulnerabilities_24.html
author: Vorant
tags:
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- /cgi-bin/%2e%2e
- /icons/%2e%2e
- '%2e%2e/%2e%2e'
- /.%2e/.%2e/
condition: selection
falsepositives:
- Vulnerability scanning tools or penetration testing performing authorized assessments
- Security researchers validating patch status
level: high
Apache CVE-2021-41773 Traversal Leading to Command Execution via CGI
Detects a web server process (httpd/apache2) spawning a shell process, consistent with remote code execution achieved via path traversal to CGI scripts in vulnerable Apache versions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Apache CVE-2021-41773 Traversal Leading to Command Execution via CGI
id: 520c006f-f2b3-594a-b8a5-1c87f5663f67
status: experimental
description: 'Detects a shell process spawned directly by the Apache HTTP Server process
(httpd/apache2), which is consistent with remote code execution achieved by chaining
the CVE-2021-41773/CVE-2021-42013 path traversal to invoke CGI scripts such as /bin/sh
on mod_cgi-enabled configurations.
'
references:
- https://httpd.apache.org/security/vulnerabilities_24.html
author: Vorant
tags:
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /httpd
- /apache2
- /httpd.worker
Image|endswith:
- /sh
- /bash
- /dash
condition: selection
falsepositives:
- Legitimate CGI scripts on the server that intentionally invoke shell interpreters
- Custom web applications using shell scripts as CGI handlers
level: high
Web Server Access to Sensitive OS Files via Path Traversal
Detects HTTP requests where traversal sequences target well-known sensitive filesystem paths such as /etc/passwd, indicating file and directory discovery via exploitation of the Apache path traversal flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Access to Sensitive OS Files via Path Traversal
id: c60e8406-b8c6-55dc-89d3-bd0e4fc7b5f1
status: experimental
description: 'Detects web server access log entries where the requested URI, after
decoding traversal sequences, resolves to sensitive operating system files (e.g.
/etc/passwd), indicating attacker discovery of files and directories outside the
intended document root, as seen in exploitation of CVE-2021-41773/CVE-2021-42013.
'
references:
- https://httpd.apache.org/security/vulnerabilities_24.html
author: Vorant
tags:
- attack.t1083
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- /etc/passwd
- /etc/shadow
- /etc/hosts
- proc/self/environ
condition: selection
falsepositives:
- Internal file inventory or compliance scanning tools that legitimately request these
paths for testing
- Authorized penetration testing activity
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/alert20211006.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free