PT-2021-4294 · Apache+1 · Apache Http Server+1
CVE-2021-41773
·
Published
2021-10-04
·
Updated
2026-06-12
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Apache HTTP Server versions 2.4.49 through 2.4.50
Description
A flaw in path normalization allows a path traversal attack to map URLs to files outside directories configured by Alias-like directives. If these files are not protected by the default "require all denied" configuration, requests can succeed. If CGI scripts are enabled for these paths, remote code execution may be possible. This issue has been exploited in the wild, with some reports indicating approximately 112,000 vulnerable hosts. Technical exploitation involves using encoded characters such as
.%2e/ to access sensitive files like /etc/passwd or executing commands via /cgi-bin/.../bin/sh.Recommendations
Update Apache HTTP Server to a version later than 2.4.50.
As a temporary workaround, ensure the "require all denied" configuration is applied to directories outside the intended alias paths.
Restrict access to the
cgi-bin directory or disable CGI scripts to minimize the risk of remote code execution.Exploit
Fix
RCE
DoS
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Apache Http Server