CVE-2021-41773
Apache HTTP Server Path Traversal Vulnerability
Description
CVE-2021-41773 is a critical-severity path traversal vulnerability in Apache HTTP Server 2.4.49 caused by a flaw in path normalization. An attacker could use a path traversal attack to map URLs to files outside directories configured by Alias-like directives, and if CGI scripts are enabled, achieve remote code execution. This vulnerability was known to be exploited in the wild, and CISA has added it to its Known Exploited Vulnerabilities catalog. The original patch in Apache HTTP Server 2.4.50 was found to be incomplete, leading to the related vulnerability CVE-2021-42013. CVE-2021-41773 is also known to be used in ransomware campaigns, and with an EPSS score of 94.4% (99.97th percentile), exploitation is near certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | http server | 2.4.49 |
| fedoraproject | fedora | 34; 35 |
| oracle | instantis enterprisetrack | 17.1; 17.2; 17.3 |
| netapp | cloud backup | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2021/10/05/2(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/07/1(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/07/6(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/08/1(Exploit, Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/08/2(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/08/3(Exploit, Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/08/4(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/08/5(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/08/6(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/09/1(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/11/4(Mailing List, Patch, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/15/3(Mailing List, Patch, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/16/1(Mailing List, Third Party Advisory)
- https://httpd.apache.org/security/vulnerabilities_24.html(Release Notes, Vendor Advisory)
- https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E(Mailing List, Patch)
- https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.httpd.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E(Mailing List)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/(Release Notes)
- https://security.gentoo.org/glsa/202208-20(Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20211029-0009/(Third Party Advisory)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ(Third Party Advisory)
- https://www.oracle.com/security-alerts/cpujan2022.html(Patch, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
In Apache HTTP Server 2.4.49, the path traversal vulnerability exists due to a flaw in the change made to path normalization. The server fails to properly neutralize directory traversal sequences in URLs, allowing attackers to escape the intended directory structure and access or execute files outside the restricted web root and Alias-configured directories.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2021-41773 carries a CVSS 3.1 score of 9.8 (CRITICAL), indicating the highest severity tier. The vulnerability is remotely exploitable over the network with low attack complexity, requiring no authentication and no user interaction. Successful exploitation can fully compromise data confidentiality by allowing access to sensitive files, enable unauthorized modification of data through file writes, and cause complete service disruption. The EPSS score of 94.4% indicates near-certain exploitation activity, and the confirmed use in ransomware campaigns makes this an emergency-level threat. Organizations running Apache HTTP Server 2.4.49 must upgrade immediately, noting that version 2.4.50 contained an incomplete fix — upgrading to 2.4.51 or later is required.
Exploit Maturity
CVE-2021-41773 has extensive exploit maturity with confirmed active exploitation in the wild. CISA has listed it in the Known Exploited Vulnerabilities catalog, and ransomware operators are known to leverage it. Public exploit code is available from multiple sources including Packet Storm Security and additional exploits covering both path traversal and remote code execution. The original patch in Apache 2.4.50 was incomplete, leading to CVE-2021-42013, meaning that organizations must upgrade to 2.4.51 or later for full protection. The EPSS score of 94.4% (99.97th percentile) confirms near-certain exploitation activity, and federal agencies were required to remediate by 2021-11-17.
Remediation
- Upgrade Apache HTTP Server immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade directly to Apache HTTP Server 2.4.51 or later — do NOT stop at version 2.4.50 as it contained an incomplete fix (see CVE-2021-42013).
- Verify that all instances of Apache HTTP Server 2.4.49 have been updated, including those deployed within Oracle Instantis EnterpriseTrack (17.1-17.3), Fedora 34 and 35, and NetApp Cloud Backup environments.
- As an interim mitigation, ensure that directories outside the document root are protected with "require all denied" directives and disable CGI execution for aliased paths to prevent remote code execution even if the traversal is exploited.
- Review web server access logs for path traversal patterns, particularly URL-encoded dot-dot-slash sequences, and conduct threat hunting to determine if the vulnerability was exploited prior to patching.
- Deploy a web application firewall with path traversal detection rules and enable real-time monitoring for anomalous file access patterns outside the configured document root.
Technical Details
CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Server 2.4.49, introduced by a flaw in a change to path normalization. The vulnerability allows attackers to craft URL requests with encoded directory traversal sequences that bypass the path normalization process, resolving to files outside the directories configured by Alias-like directives. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects maximum exploitability: network-accessible, low complexity, no authentication, and no user interaction. When directories outside the document root lack "require all denied" restrictions, the traversal allows unauthorized file access. When CGI scripts are enabled for these aliased paths, the vulnerability escalates to full remote code execution. The fix in Apache 2.4.50 was found to be incomplete (CVE-2021-42013), requiring a further update to 2.4.51.
Frequently Asked Questions
Is CVE-2021-41773 being actively exploited?
Yes. CVE-2021-41773 was exploited in the wild before disclosure and is listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability is known to be used in ransomware campaigns. The EPSS score of 94.4% (99.97th percentile) indicates near-certain exploitation.
What products are affected by CVE-2021-41773?
CVE-2021-41773 affects Apache HTTP Server version 2.4.49 only (not earlier versions). Additionally affected are Fedora 34 and 35, Oracle Instantis EnterpriseTrack (17.1-17.3), and NetApp Cloud Backup.
How do I fix CVE-2021-41773?
Upgrade Apache HTTP Server directly to version 2.4.51 or later. Do NOT upgrade to 2.4.50 as it contained an incomplete fix that was bypassed by CVE-2021-42013. As an interim measure, protect directories outside the document root with "require all denied" and disable CGI for aliased paths.
How severe is CVE-2021-41773?
CVE-2021-41773 has a CVSS 3.1 score of 9.8 (CRITICAL) and an EPSS score of 94.4% (99.97th percentile). The vulnerability enables remote code execution without authentication and is actively used in ransomware campaigns, requiring emergency remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.