Pierluigi Paganini October 09, 2021

Security expert Dhiraj Mishra published an NMAP script for the CVE-2021-41773 Path Traversal vulnerability affecting Apache Web Server version 2.4.49.

Security researcher Dhiraj Mishra released an NMAP script for the CVE-2021-41773 path traversal vulnerability affecting Apache Web Server version 2.4.49.

This week Apache Software Foundation has released HTTP Web Server 2.4.51 to address an actively exploited path traversal vulnerability (CVE-2021-41773) that was only partially addressed with a previous release.

An attacker can trigger the flaw to map URLs to files outside the expected document root.

“A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root.” reads the advisory. “If files outside of the document root are not protected by “require all denied” these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts.”

The vulnerability affects only version 2.4.49, earlier versions are not impacted. A few days ago, Apache released Apache HTTP 2.4.50 to address the CVE-2021-41773

Immediately after the release of the Apache HTTP 2.4.50 experts disclosed that the exploitation of the flaw could lead to remote code execution when the mod_cgi module was loaded and the default “Require all denied” option was missing.

According to an updated advisory, Apache released version 2.4.51 to definitively fix the vulnerability. This new path traversal flaws is tracked as CVE-2021-42013.

“It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives,” announced Apache in an updated advisory. “If files outside of these directories are not protected by the usual default configuration “require all denied”, these requests can succeed. If CGI scripts are also enabled for these aliased patches, this could allow for remote code execution.”

The vulnerability was reported by Juan Escobar from Dreamlab Technologies, Fernando Muñoz from NULL Life CTF Team, and Shungo Kumasaka.

The United States Computer Emergency Readiness Team (US-CERT) warns of ongoing active scanning of Apache HTTP Server CVE-2021-41773 and CVE-2021-42013 that could lead to imminent exploitation, for this reason, the US-CERT urges organizations to immediately patch their installs.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Apache)

[adrotate banner=”5″]

[adrotate banner=”13″]