PT-2021-4294 · Apache+1 · Apache Http Server+1

Published 2021-10-04 · Updated 2026-05-16 · CVE-2021-41773

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.49 through 2.4.50

Description A flaw in path normalization allows a remote attacker to perform a path traversal attack, mapping URLs to files outside the directories configured by Alias-like directives. This occurs if the files are not protected by the default "require all denied" configuration. If CGI scripts are enabled for these paths, the issue can lead to remote code execution. This issue has been exploited in the wild.

Recommendations Update Apache HTTP Server to a version later than 2.4.50. As a temporary workaround, ensure that the configuration "require all denied" is applied to directories outside the intended alias paths and restrict the use of CGI scripts in those locations.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALSA-2021_3816

ALSA-2022_0891

ALSA-2022_1915

ALSA-2023_1670

ALSA-2023_1673

ALSA-2025_16880

ALT-PU-2021-2994

ALT-PU-2021-3018

ALT-PU-2021-3037

ALT-PU-2021-3060

BDU:2021-04903

BIT-APACHE-2021-41773

CVE-2021-41773

MGASA-2021-0461

OPENSUSE-SU-2024:11560-1

Affected Products

Alt Linux

Apache Http Server

References · 291

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/apache_normalize_path.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_normalize_path_rce.rb · Exploit
• 🔥 https://github.com/blasty/CVE-2021-41773 · Exploit
• 🔥 https://github.com/inbug-team/CVE-2021-41773_CVE-2021-42013 · Exploit
• 🔥 https://github.com/thehackersbrain/CVE-2021-41773 · Exploit
• 🔥 https://github.com/iilegacyyii/PoC-CVE-2021-41773 · Exploit
• 🔥 https://github.com/HightechSec/scarce-apache2 · Exploit
• 🔥 https://github.com/MrCl0wnLab/SimplesApachePathTraversal · Exploit
• 🔥 https://github.com/lorddemon/CVE-2021-41773-PoC · Exploit
• 🔥 https://github.com/Vulnmachines/cve-2021-41773 · Exploit
• 🔥 https://github.com/justakazh/mass_cve-2021-41773 · Exploit
• 🔥 https://github.com/htrgouvea/lab-cve-2021-41773 · Exploit
• 🔥 https://github.com/BlueTeamSteve/CVE-2021-41773 · Exploit
• 🔥 https://github.com/im-hanzou/apachrot · Exploit
• 🔥 https://github.com/Ls4ss/CVE-2021-41773_CVE-2021-42013 · Exploit