CVE-2021-42013 Overview
CVE-2021-42013 is a path traversal vulnerability in Apache HTTP Server 2.4.49 and 2.4.50. The flaw exists because the fix for CVE-2021-41773 in version 2.4.50 was insufficient to block encoded traversal sequences. Attackers can map URLs to files outside directories configured by Alias-like directives. When CGI scripts are enabled for aliased paths, exploitation yields remote code execution (RCE). The vulnerability is tracked under [CWE-22] and is listed in the CISA Known Exploited Vulnerabilities catalog.
Critical Impact
Unauthenticated remote attackers can achieve arbitrary file read and remote code execution on Apache HTTP Server 2.4.49 and 2.4.50 instances. The EPSS score is 94.41%, indicating very high exploitation likelihood.
Affected Products
- Apache HTTP Server 2.4.49 and 2.4.50
- Fedora 34 and 35
- Oracle Instantis EnterpriseTrack 17.1, 17.2, 17.3; Oracle JD Edwards EnterpriseOne Tools; Oracle Secure Backup
- NetApp Cloud Backup
Discovery Timeline
- 2021-10-07 - CVE-2021-42013 published to NVD
- 2025-10-27 - Last updated in NVD database
Technical Details for CVE-2021-42013
Vulnerability Analysis
The vulnerability is a path traversal flaw in Apache HTTP Server's URL normalization logic. Apache 2.4.49 introduced a regression that allowed .. sequences to escape document roots. The 2.4.50 patch normalized literal .. but failed to handle double-encoded traversal sequences. Attackers can submit URLs containing encoded dot-dot sequences such as %%32%65 to bypass the fix.
When the request targets a path covered by an Alias or ScriptAlias directive and the filesystem lacks a require all denied access control, the server resolves the request to files outside the intended directory. If CGI execution (mod_cgi) is enabled for the aliased path, the attacker can invoke binaries such as /bin/sh to execute arbitrary commands as the Apache user.
Root Cause
The root cause is incomplete input validation in path normalization. The 2.4.50 fix only decoded one layer of URL encoding before sanitizing traversal characters. Encoded representations of the dot character survived sanitization and were decoded later in request processing, reintroducing the traversal primitive.
Attack Vector
Exploitation requires a network-reachable Apache instance running version 2.4.49 or 2.4.50 with default require all denied removed or with Alias directives mapping to directories where access is permitted. The attacker sends a crafted HTTP request with double-encoded .. sequences in the URL path. For RCE, the target path must permit CGI execution. No authentication or user interaction is required. Public exploit code is available on Packet Storm and Exploit-DB.
Detection Methods for CVE-2021-42013
Indicators of Compromise
- HTTP access logs containing requests with encoded traversal sequences such as %%32%65, .%2e/, or %2e%2e/ against /cgi-bin/ or other aliased paths.
- Unexpected child processes spawned by httpd or apache2, particularly sh, bash, id, uname, or curl.
- Outbound network connections from the web server process to attacker-controlled infrastructure shortly after suspicious URL requests.
- HTTP 200 responses to requests targeting /bin/sh or system binaries via CGI endpoints.
Detection Strategies
- Deploy web application firewall (WAF) rules that decode URLs recursively before matching against traversal patterns.
- Inspect Apache access_log and error_log for requests containing repeated percent-encoding within path segments.
- Use endpoint detection telemetry to alert on httpd or apache2 spawning shell interpreters.
- Correlate process execution events with inbound HTTP requests for high-fidelity identification.
Monitoring Recommendations
- Forward Apache access logs to a centralized SIEM and apply detection rules for double-encoded traversal patterns.
- Monitor file integrity on /etc/passwd, /etc/shadow, and CGI directories for unauthorized reads or modifications.
- Track outbound DNS and HTTP traffic from web server hosts to identify post-exploitation command-and-control activity.
How to Mitigate CVE-2021-42013
Immediate Actions Required
- Upgrade Apache HTTP Server to version 2.4.51 or later immediately on all affected hosts.
- Audit all Alias, ScriptAlias, and <Directory> directives to ensure require all denied is the default policy.
- Disable mod_cgi and mod_cgid where CGI execution is not required.
- Review web server logs from October 2021 onward for signs of prior exploitation.
Patch Information
The Apache Software Foundation released version 2.4.51, which fully addresses both CVE-2021-41773 and CVE-2021-42013. Vendor advisories are available from the Apache Security Vulnerability List, Fedora Package Announcement, NetApp Security Advisory, Cisco Security Advisory, and the Oracle CPU January 2022 Advisory. The fix is referenced in the Apache Commit Mailing List Thread.
Workarounds
- If patching is not immediately possible, ensure every <Directory /> block contains Require all denied to block traversal outside document roots.
- Disable CGI modules with a2dismod cgi cgid on Debian-based systems or by commenting out LoadModule cgi_module in httpd.conf.
- Deploy WAF signatures that block requests containing %2e%2e, %%32%65, or other encoded traversal indicators.
# Verify Apache version and disable CGI as a temporary workaround
httpd -v
# Expected output should show 2.4.51 or later
# Debian/Ubuntu: disable CGI modules
sudo a2dismod cgi cgid
sudo systemctl restart apache2
# Ensure default deny policy in httpd.conf
# <Directory />
# AllowOverride none
# Require all denied
# </Directory>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
