Apache HTTP Server Path Traversal Vulnerability
Apache · HTTP Server
The flaw is a path traversal weakness in the path normalization logic of Apache HTTP Server, product HTTP Server, introduced by a change in version 2.4.49. An unauthenticated remote attacker can send crafted requests over the network, with no user interaction, to map URLs to files outside the directories configured by Alias-like directives, and if those files are not protected by the default "require all denied" setting, the requests succeed; where CGI scripts are also enabled for the aliased paths, this can lead to remote code execution.
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 2/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 6 days before it was disclosed. Public exploit code (Metasploit) was available 5 months before disclosure.
- Public exploit codeMetasploit5 mo before
- First seen exploitedVulnCheck KEV evidence6 days before
- Disclosedday 0
- Added to CISA KEVknown ransomware use; EU database agrees+29 days
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
See the family treeA fix was bypassed or incomplete once over 2 days.
Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.
- This CVECVE-2021-41773HTTP Server Path Traversal5 Oct 2021KEV
incomplete fixHigh
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Stated in the CVE text
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient.
- Similar weakness in the same product (machine-matched)same product + CWE + description similarity
- Stated in the CVE text
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
2 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 2ExecutionTA0002
CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows an attacker to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied," these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution.
Lateral MovementTA0008
Detection
1 rule for this CVE · 110 general rules for its techniquesRules for this CVE
1Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2021-41773 directly.General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Exploitation of Remote ServicesT121015 general rules
- Zerologon Exploitation Using Well-known Toolscriticalstable
- Audit CVE Eventcriticaltest
- WannaCry Ransomware Activitycriticaltest
- OMIGOD HTTP No Authentication RCE - CVE-2021-38647highstable
- Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoChightest
- Exploitation Attempt Of CVE-2023-46214 Using Public POC Codehightest
- HackTool - SharpWSUS/WSUSpendu Executionhightest
- Possible Exploitation of Exchange RCE CVE-2021-42321hightest
Command and Scripting InterpreterT105995 general rules
- HackTool - Sliver C2 Implant Activity Patterncriticaltest
- Lazarus Group Activitycriticaltest
- REvil Kaseya Incident Malware Patternscriticaltest
- Turla Group Lateral Movementcriticaltest
- Windows Defender AMSI Trigger Detectedhighstable
- Windows Defender Threat Detectedhighstable
- Abusable DLL Potential Sideloading From Suspicious Locationhightest
- Add Insecure Download Source To Wingethightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX