# Apache HTTP Server path traversal exploited in Japan

Published: 2021-10-07 · Severity: high
Canonical: https://vorant.io/reports/5dcef1ac-4f74-5fd3-b0b3-a0d2e52e4266/apache-http-server-path-traversal-exploited-in-japan

> Attackers are actively exploiting a path traversal flaw in Apache HTTP Server (CVE-2021-41773), with an incomplete fix leading to a second CVE (CVE-2021-42013).

The Information-technology Promotion Agency (IPA) Japan issued an alert regarding a path traversal and file disclosure vulnerability in Apache HTTP Server, tracked as CVE-2021-41773. The flaw allows remote attackers to access files outside the intended document root, potentially leading to source code disclosure or, in certain configurations, remote code execution via CGI scripts. IPA confirmed that attacks exploiting this vulnerability have been observed within Japan, prompting an urgent call for organizations to patch immediately.

The initial fix released in Apache HTTP Server version 2.4.50 was later found to be incomplete, resulting in a second vulnerability, CVE-2021-42013, which shares the same root cause and attack vector. The Apache Software Foundation subsequently released version 2.4.51 to fully address both issues. IPA updated its advisory to reflect this development and urged administrators to apply the latest patch rather than relying on the earlier partial fix.

Given the active exploitation observed in the wild and the widespread deployment of Apache HTTP Server, this represents a significant and urgent patching priority for any organization running affected versions, particularly those exposing Apache servers to the internet.

## Mentioned in this report

- Vulnerabilities: CVE-2021-41773 (KEV), CVE-2021-42013 (KEV)

## Detection guidance (public sample)

### Apache Path Traversal Exploitation Attempt (CVE-2021-41773/CVE-2021-42013)

ATT&CK: T1190

Detects HTTP requests containing the encoded path traversal sequence used to escape the Apache document root via /cgi-bin/ or /icons/ aliases. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Apache Path Traversal Exploitation Attempt (CVE-2021-41773/CVE-2021-42013)
id: 16a5d5e2-4906-57d5-ac10-b8c4302b9265
status: experimental
description: 'Detects HTTP requests exploiting CVE-2021-41773 and CVE-2021-42013,
  Apache HTTP Server path traversal vulnerabilities that allow access to files outside
  the document root via encoded ''../'' sequences targeting aliased paths such as
  /cgi-bin/ or /icons/.

  '
references:
- https://httpd.apache.org/security/vulnerabilities_24.html
author: Vorant
tags:
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
    - /cgi-bin/%2e%2e
    - /icons/%2e%2e
    - '%2e%2e/%2e%2e'
    - /.%2e/.%2e/
  condition: selection
falsepositives:
- Vulnerability scanning tools or penetration testing performing authorized assessments
- Security researchers validating patch status
level: high
```

### Apache CVE-2021-41773 Traversal Leading to Command Execution via CGI

ATT&CK: T1190

Detects a web server process (httpd/apache2) spawning a shell process, consistent with remote code execution achieved via path traversal to CGI scripts in vulnerable Apache versions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Apache CVE-2021-41773 Traversal Leading to Command Execution via CGI
id: 520c006f-f2b3-594a-b8a5-1c87f5663f67
status: experimental
description: 'Detects a shell process spawned directly by the Apache HTTP Server process
  (httpd/apache2), which is consistent with remote code execution achieved by chaining
  the CVE-2021-41773/CVE-2021-42013 path traversal to invoke CGI scripts such as /bin/sh
  on mod_cgi-enabled configurations.

  '
references:
- https://httpd.apache.org/security/vulnerabilities_24.html
author: Vorant
tags:
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /httpd
    - /apache2
    - /httpd.worker
    Image|endswith:
    - /sh
    - /bash
    - /dash
  condition: selection
falsepositives:
- Legitimate CGI scripts on the server that intentionally invoke shell interpreters
- Custom web applications using shell scripts as CGI handlers
level: high
```

### Web Server Access to Sensitive OS Files via Path Traversal

ATT&CK: T1083

Detects HTTP requests where traversal sequences target well-known sensitive filesystem paths such as /etc/passwd, indicating file and directory discovery via exploitation of the Apache path traversal flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Access to Sensitive OS Files via Path Traversal
id: c60e8406-b8c6-55dc-89d3-bd0e4fc7b5f1
status: experimental
description: 'Detects web server access log entries where the requested URI, after
  decoding traversal sequences, resolves to sensitive operating system files (e.g.
  /etc/passwd), indicating attacker discovery of files and directories outside the
  intended document root, as seen in exploitation of CVE-2021-41773/CVE-2021-42013.

  '
references:
- https://httpd.apache.org/security/vulnerabilities_24.html
author: Vorant
tags:
- attack.t1083
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
    - /etc/passwd
    - /etc/shadow
    - /etc/hosts
    - proc/self/environ
  condition: selection
falsepositives:
- Internal file inventory or compliance scanning tools that legitimately request these
  paths for testing
- Authorized penetration testing activity
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/alert20211006.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5dcef1ac-4f74-5fd3-b0b3-a0d2e52e4266/apache-http-server-path-traversal-exploited-in-japan.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup