CVE-2021-41773: Apache HTTP Server Path Traversal Flaw

CVE-2021-41773 Overview

CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows attackers to map URLs to files outside directories configured by Alias-like directives. This flaw stems from a change made to path normalization in Apache HTTP Server 2.4.49. When files outside of configured directories are not protected by the default "require all denied" configuration, attackers can successfully access sensitive files. More critically, if CGI scripts are enabled for these aliased paths, the vulnerability escalates to remote code execution (RCE).

This vulnerability is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed malicious exploitation. It is important to note that the initial fix in Apache HTTP Server 2.4.50 was found to be incomplete, leading to the identification of a related vulnerability, CVE-2021-42013.

Critical Impact

This vulnerability enables unauthenticated remote attackers to read arbitrary files and potentially achieve remote code execution on vulnerable Apache HTTP Server 2.4.49 instances when CGI is enabled.

Affected Products

• Apache HTTP Server 2.4.49
• Fedora 34 and 35 (via httpd package)
• Oracle Instantis EnterpriseTrack 17.1, 17.2, and 17.3
• NetApp Cloud Backup

Discovery Timeline

• 2021-10-05 - CVE-2021-41773 published to NVD
• 2026-02-17 - Last updated in NVD database

Technical Details for CVE-2021-41773

Vulnerability Analysis

The vulnerability resides in the path normalization code introduced in Apache HTTP Server version 2.4.49. The flawed normalization logic fails to properly sanitize URL-encoded path traversal sequences, specifically the dot-dot-slash (../) pattern when URL-encoded as .%2e/ or %2e%2e/. This improper validation allows attackers to escape the document root and access files anywhere on the filesystem that the Apache process has read permissions for.

The attack surface significantly expands when the server has CGI scripts enabled (mod_cgi or mod_cgid). In such configurations, attackers can not only read arbitrary files but also execute arbitrary commands on the server by invoking executables like /bin/sh through the path traversal technique.

Root Cause

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The vulnerability was introduced during changes to the ap_normalize_path() function in Apache 2.4.49. The updated normalization logic incorrectly handles certain URL-encoded representations of the path traversal sequence, allowing encoded dots to bypass directory restrictions.

Specifically, the code failed to properly decode and validate sequences where the dot characters were URL-encoded before the normalization check occurred. This created a window where malicious paths could pass validation but still resolve to locations outside the intended directory structure when the server processed the request.

Attack Vector

The attack is executed remotely over the network without requiring any authentication or user interaction. Attackers craft HTTP requests containing specially encoded path traversal sequences to access files outside the web root directory.

For file disclosure, an attacker sends a GET request with a path like /cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd to read the system password file. The double-dot sequences, when URL-encoded with .%2e, bypass the path normalization checks.

For remote code execution, when CGI is enabled, attackers can execute commands by targeting scripts like /bin/sh. A request to /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh with a POST body containing the command to execute allows arbitrary command execution on the server. Technical details and proof-of-concept examples are available in the Packet Storm Apache RCE Exploit publication.

Detection Methods for CVE-2021-41773

Indicators of Compromise

• HTTP request logs containing URL-encoded path traversal sequences such as .%2e/, %2e%2e/, or %2e./ in the URI path
• Access attempts to sensitive system files like /etc/passwd, /etc/shadow, or application configuration files
• Requests targeting /cgi-bin/ paths with traversal sequences attempting to reach /bin/sh, /bin/bash, or other executables
• Unusual POST requests to paths containing traversal sequences with command-like data in the request body

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block URL-encoded path traversal patterns including .%2e, %2e%2e, and %2e. sequences
• Implement intrusion detection system (IDS) signatures for Apache path traversal exploitation attempts targeting version 2.4.49
• Monitor Apache access logs for 200 status codes on requests containing double-dot sequences accessing non-web directories
• Correlate web server logs with process execution monitoring to detect CGI-based command execution following traversal attempts

Monitoring Recommendations

• Enable detailed access logging in Apache with full URI request logging to capture encoded characters
• Monitor for anomalous file access patterns on the web server, particularly reads of system configuration files
• Implement real-time alerting for any successful (HTTP 200) responses to requests containing path traversal patterns
• Review process creation logs for unexpected child processes spawned by the Apache httpd worker processes

How to Mitigate CVE-2021-41773

Immediate Actions Required

• Upgrade Apache HTTP Server to version 2.4.51 or later immediately, as the 2.4.50 patch was found to be incomplete
• If immediate patching is not possible, disable CGI functionality by removing or commenting out LoadModule cgi_module and LoadModule cgid_module directives
• Ensure all directories outside the web root are protected with Require all denied directives in the Apache configuration
• Review firewall and WAF configurations to block requests containing URL-encoded traversal sequences

Patch Information

Apache has released version 2.4.51 which fully addresses this vulnerability. The fix in version 2.4.50 was found to be incomplete and was subsequently addressed by CVE-2021-42013. Organizations should upgrade directly to version 2.4.51 or later to ensure complete remediation.

Patch information is available from the Apache HTTP Server Security Vulnerabilities page. Additional security guidance has been published by Oracle, Cisco, and NetApp for their respective affected products.

Workarounds

• Configure explicit Require all denied directives for all directory locations outside the intended web root to block unauthorized access
• Disable CGI script execution by removing mod_cgi and mod_cgid modules if not required for application functionality
• Implement network segmentation to limit exposure of Apache servers and restrict access to trusted networks only
• Deploy reverse proxy or WAF in front of Apache servers with rules blocking encoded path traversal patterns

# Apache configuration hardening example
# Add to httpd.conf or apache2.conf to restrict directory access

# Deny access to the entire filesystem by default
<Directory />
    Require all denied
</Directory>

# Only allow access to your specific document root
<Directory /var/www/html>
    Require all granted
</Directory>

# Disable CGI if not needed
# Comment out these lines in httpd.conf:
# LoadModule cgi_module modules/mod_cgi.so
# LoadModule cgid_module modules/mod_cgid.so