CVE-2021-41773: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.
Other sources
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.50Patch CVE-2021-42013 - Configuration
Ensure that any requests resolving to files outside the directories configured by Alias-like directives are blocked by applying the usual default access control rule "require all denied".
Apache HTTP Server (Alias-like directives) access control for files outside aliased directories (require directive) = require all denied - Configuration
If CGI scripts are enabled for the aliased paths, disable CGI execution for those aliased locations to prevent remote code execution from path traversal.
Apache HTTP Server (CGI for aliased paths) CGI execution enabled for aliased paths = disabled - Compensating control
Because this issue is known to be exploited in the wild, monitor Apache access logs for attempted path traversal and file disclosure attempts, and consider temporarily restricting access to the affected vhosts/locations via network controls while remediation is applied.
Event History
Frequently Asked Questions
What is the CVE ID for this vulnerability?
CVE-2021-41773
What is the title of this vulnerability?
Apache HTTP Server Path Traversal Vulnerability
What is the severity of CVE-2021-41773?
The severity of CVE-2021-41773 is marked as high with a severity value of 7.5.
How does CVE-2021-41773 affect Apache HTTP Server?
CVE-2021-41773 affects Apache HTTP Server version 2.4.49.
How can I fix the Apache HTTP Server Path Traversal Vulnerability?
To fix the Apache HTTP Server Path Traversal Vulnerability, update Apache HTTP Server to version 2.4.50 or higher.