CVE-2021-42013
Apache HTTP Server Path Traversal Vulnerability
Description
CVE-2021-42013 is a critical-severity path traversal vulnerability in Apache HTTP Server versions 2.4.49 and 2.4.50 that can lead to remote code execution. This vulnerability represents an incomplete fix for CVE-2021-41773, where an attacker could use a path traversal attack to map URLs to files outside directories configured by Alias-like directives. If CGI scripts are enabled for these aliased paths, this allows for remote code execution. CISA has added CVE-2021-42013 to its Known Exploited Vulnerabilities catalog, and the vulnerability is known to be used in ransomware campaigns. With an EPSS score of 94.4% (99.98th percentile), exploitation is near certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | http server | 2.4.49; 2.4.50 |
| fedoraproject | fedora | 34; 35 |
| oracle | instantis enterprisetrack | 17.1; 17.2; 17.3 |
| oracle | jd edwards enterpriseone tools | < 9.2.6.0 |
| oracle | secure backup | < 18.1.0.1.0 |
| netapp | cloud backup | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://jvn.jp/en/jp/JVN51106450/index.html(Third Party Advisory)
- http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2021/10/07/6(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/08/1(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/08/2(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/08/3(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/08/4(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/08/5(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/08/6(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/09/1(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/11/4(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/15/3(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/10/16/1(Mailing List, Third Party Advisory)
- https://httpd.apache.org/security/vulnerabilities_24.html(Release Notes, Vendor Advisory)
- https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E(Mailing List, Patch)
- https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E(Mailing List)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/(Release Notes)
- https://security.gentoo.org/glsa/202208-20(Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20211029-0009/(Third Party Advisory)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ(Third Party Advisory)
- https://www.oracle.com/security-alerts/cpuapr2022.html(Patch, Third Party Advisory)
- https://www.oracle.com/security-alerts/cpujan2022.html(Patch, Third Party Advisory)
- https://www.povilaika.com/apache-2-4-50-exploit/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42013(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
In Apache HTTP Server, the path traversal vulnerability allows attackers to craft URL requests that escape the restricted directory structure configured by Alias-like directives. The incomplete fix in version 2.4.50 failed to properly neutralize all encoding variants of directory traversal sequences, enabling attackers to access arbitrary files on the server and potentially execute CGI scripts outside the intended directories.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2021-42013 carries a CVSS 3.1 score of 9.8 (CRITICAL), representing the maximum severity tier. The vulnerability is remotely exploitable over the network with low attack complexity, requiring no authentication and no user interaction. Successful exploitation fully compromises confidentiality, integrity, and availability, allowing attackers to read sensitive files, modify server content, and execute arbitrary code on the server when CGI is enabled. The EPSS score of 94.4% indicates near-certain exploitation activity, and the confirmed use in ransomware campaigns makes this an emergency-level threat. Organizations running Apache HTTP Server 2.4.49 or 2.4.50 face critical risk of complete server compromise.
Exploit Maturity
CVE-2021-42013 has extensive exploit maturity with numerous public exploits available and confirmed active exploitation. CISA has listed it in the Known Exploited Vulnerabilities catalog, and the vulnerability is known to be leveraged in ransomware campaigns. Public exploit code is available from multiple sources including Packet Storm Security, a remote code execution variant, and additional exploits. This vulnerability is the bypass of the incomplete patch for CVE-2021-41773, meaning organizations that only applied the 2.4.50 update remain vulnerable. The EPSS score of 94.4% (99.98th percentile) confirms near-certain exploitation, and federal agencies were required to remediate by 2021-11-17.
Remediation
- Upgrade Apache HTTP Server immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade to Apache HTTP Server 2.4.51 or later, which fully addresses both CVE-2021-41773 and CVE-2021-42013.
- Verify that all instances of Apache HTTP Server 2.4.49 and 2.4.50 have been updated, including those deployed within Oracle (Instantis EnterpriseTrack, JD Edwards EnterpriseOne Tools, Secure Backup), Fedora, and NetApp Cloud Backup environments.
- As an interim mitigation, ensure that directories outside the document root are protected with "require all denied" directives in the Apache configuration, and disable CGI execution for aliased paths.
- Review web server access logs for path traversal patterns, particularly requests containing URL-encoded dot-dot-slash sequences targeting paths outside configured Alias directories.
- Implement a web application firewall with rules to detect and block path traversal attempts using various encoding schemes, and enable intrusion detection monitoring for file access outside the web root.
Technical Details
CVE-2021-42013 is a path traversal vulnerability in Apache HTTP Server affecting versions 2.4.49 and 2.4.50. It resulted from an incomplete fix for CVE-2021-41773 in version 2.4.50, where the path normalization logic failed to account for additional encoding variants of the dot-dot-slash traversal sequence. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the maximum exploitability: network-accessible, low complexity, no authentication, no user interaction. Attackers exploit the vulnerability by crafting URLs with encoded traversal sequences that bypass the path normalization, mapping requests to files outside directories configured by Alias-like directives. When the server is configured with CGI enabled for aliased paths and directories outside the document root lack "require all denied" restrictions, the traversal can be escalated to full remote code execution by targeting CGI-capable directories.
Frequently Asked Questions
Is CVE-2021-42013 being actively exploited?
Yes. CVE-2021-42013 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The vulnerability is known to be used in ransomware campaigns. The EPSS score of 94.4% (99.98th percentile) indicates near-certain exploitation activity, and multiple public exploits are widely available.
What products are affected by CVE-2021-42013?
CVE-2021-42013 affects Apache HTTP Server versions 2.4.49 and 2.4.50. Additionally affected are Fedora 34 and 35, Oracle Instantis EnterpriseTrack (17.1-17.3), Oracle JD Edwards EnterpriseOne Tools (before 9.2.6.0), Oracle Secure Backup (before 18.1.0.1.0), and NetApp Cloud Backup.
How do I fix CVE-2021-42013?
Upgrade Apache HTTP Server to version 2.4.51 or later. As an interim measure, ensure all directories outside the document root have "require all denied" directives and disable CGI execution for aliased paths. Note that version 2.4.50 is NOT sufficient as it contained an incomplete fix.
How severe is CVE-2021-42013?
CVE-2021-42013 has a CVSS 3.1 score of 9.8 (CRITICAL) and an EPSS score of 94.4% (99.98th percentile). The vulnerability enables remote code execution without authentication and is actively used in ransomware campaigns, requiring emergency remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.