PT-2021-4295 · Apache+1 · Apache Http Server+1

Published 2021-10-07 · Updated 2026-05-31 · CVE-2021-42013

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache HTTP Server version 2.4.49 Apache HTTP Server version 2.4.50

Description An insufficient fix for a previous path traversal issue allows a remote attacker to map URLs to files outside the directories configured by Alias-like directives. This occurs when files outside these directories are not protected by the default "require all denied" configuration. If CGI scripts are enabled for these aliased paths, the flaw can lead to remote code execution. Technical exploitation involves sending specially crafted HTTP requests, sometimes utilizing obfuscation such as %%32%65 targeting /cgi-bin/.../bin/sh on ports 80 and 443.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Path traversal

OS Command Injection

Weakness Enumeration

CWE-22

CWE-78

Related Identifiers

ALSA-2025_16880

ALT-PU-2021-2994

ALT-PU-2021-3013

ALT-PU-2021-3018

ALT-PU-2021-3037

ALT-PU-2021-3060

BDU:2021-04904

BIT-APACHE-2021-42013

CVE-2021-42013

MGASA-2021-0470

OPENSUSE-SU-2024:11560-1

Affected Products

Alt Linux

Apache Http Server

References · 131

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/apache_normalize_path.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_normalize_path_rce.rb · Exploit
• 🔥 https://github.com/tangxiaofeng7/CVE-2022-22947-Spring-Cloud-Gateway · Exploit
• 🔥 https://github.com/walnutsecurity/cve-2021-42013 · Exploit
• 🔥 https://github.com/Vulnmachines/cve-2021-42013 · Exploit
• 🔥 https://github.com/andrea-mattioli/apache-exploit-CVE-2021-42013 · Exploit
• 🔥 https://github.com/asaotomo/CVE-2021-42013-Apache-RCE-Poc-Exp · Exploit
• 🔥 https://github.com/TheLastVvV/CVE-2021-42013_Reverse-Shell · Exploit
• 🔥 https://github.com/twseptian/cve-2021-42013-docker-lab · Exploit
• 🔥 https://github.com/BassoNicolas/CVE-2021-42013 · Exploit
• 🔥 https://exploit-db.com/exploits/50446 · Exploit
• 🔥❌ https://github.com/ahmad4fifz/CVE-2021-42013 · Exploit, Deleted
• 🔥 http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html · Exploit