CVE-2021-41773

Scores

EPSS Score

0.9440

CVSS

3.x 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

All CVSS Scores

CVSS 4.0

0.0

CVSS 3.x

7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS 2.0

4.3

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Description

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

Sources

debiannvdubuntu

CWEs

CWE-22

Related Vulnerabilities

BDU:2021-04903

Exploits

Exploit ID: CVE-2021-41773

Source: cisa

URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit ID: 50383

Source: exploitdb

URL: https://www.exploit-db.com/exploits/50383

Exploit ID: 50512

Source: exploitdb

URL: https://www.exploit-db.com/exploits/50512

Reference Links

http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html

http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html

http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html

http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html

http://www.openwall.com/lists/oss-security/2021/10/05/2

http://www.openwall.com/lists/oss-security/2021/10/07/1

http://www.openwall.com/lists/oss-security/2021/10/07/6

http://www.openwall.com/lists/oss-security/2021/10/08/1

http://www.openwall.com/lists/oss-security/2021/10/08/2

http://www.openwall.com/lists/oss-security/2021/10/08/3

http://www.openwall.com/lists/oss-security/2021/10/08/4

http://www.openwall.com/lists/oss-security/2021/10/08/5

http://www.openwall.com/lists/oss-security/2021/10/08/6

http://www.openwall.com/lists/oss-security/2021/10/09/1

http://www.openwall.com/lists/oss-security/2021/10/11/4

http://www.openwall.com/lists/oss-security/2021/10/15/3

http://www.openwall.com/lists/oss-security/2021/10/16/1

https://httpd.apache.org/security/vulnerabilities_24.html

https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.httpd.apache.org%3E

https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E

https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E

https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/

https://security.gentoo.org/glsa/202208-20

https://security.netapp.com/advisory/ntap-20211029-0009/

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ

https://www.oracle.com/security-alerts/cpujan2022.html

https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773

https://www.openwall.com/lists/oss-security/2021/10/05/2

https://httpd.apache.org/security/vulnerabilities_24.html

https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f

%3Cusers.httpd.apache.org%3E

https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45

%3Cannounce.apache.org%3E

http://www.openwall.com/lists/oss-security/2021/10/05/2

https://www.cve.org/CVERecord?id=CVE-2021-41773

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

https://www.cve.org/CVERecord?id=CVE-2021-41773 https://nvd.nist.gov/vuln/detail/CVE-2021-41773 https://httpd.apache.org/security/vulnerabilities_24.html https://www.cisa.gov/known-exploited-vulnerabilities-catalog

https://bugzilla.redhat.com/show_bug.cgi?id=2010757

Vulnerable Software

Type: Configuration

Product: apache2

Operating System: ubuntu bionic 18.04

Trait:

{
  "unaffected": true
}

Source: ubuntu

Type: Configuration

Product: apache2

Operating System: ubuntu focal 20.04

Trait:

{
  "unaffected": true
}

Source: ubuntu

Type: Configuration

Product: apache2

Operating System: ubuntu hirsute 21.04

Trait:

{
  "unaffected": true
}

Source: ubuntu

Type: Configuration

Product: apache2

Operating System: ubuntu impish 21.10

Trait:

{
  "unaffected": true
}

Source: ubuntu

Type: Configuration

Product: apache2

Operating System: ubuntu jammy 22.04

Trait:

{
  "unaffected": true
}

Source: ubuntu

Type: Configuration

Product: apache2

Operating System: ubuntu trusty 14.04

Trait:

{
  "unaffected": true
}

Source: ubuntu

Type: Configuration

Product: apache2

Operating System: ubuntu xenial 16.04

Trait:

{
  "unaffected": true
}

Source: ubuntu

Type: Configuration

Product: apache2

Operating System: debian

Trait:

{
  "fixed": "2.4.50-1"
}

Source: debian

Type: Configuration

Product: apache2

Operating System: debian bullseye 11

Trait:

{
  "unaffected": true
}

Source: debian

Type: Configuration

Product: apache2

Operating System: debian buster 10

Trait:

{
  "unaffected": true
}

Source: debian

Type: Configuration

Product: apache2

Operating System: debian stretch 9

Trait:

{
  "unaffected": true
}

Source: debian

Type: Configuration

Vendor: apache

Product: http_server

Operating System: * * *

Trait:

{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:a:apache:http_server:2.4.49:*:*:*:*:*:*:*",
      "vulnerable": true
    }
  ],
  "operator": "OR"
}

Source: nvd

Type: Configuration

Vendor: fedoraproject

Product: fedora

Operating System: * * *

Trait:

{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
      "vulnerable": true
    }
  ],
  "operator": "OR"
}

Source: nvd

Type: Configuration

Vendor: netapp

Product: cloud_backup

Operating System: * * *

Trait:

{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
      "vulnerable": true
    }
  ],
  "operator": "OR"
}

Source: nvd

Type: Configuration

Vendor: oracle

Product: instantis_enterprisetrack

Operating System: * * *

Trait:

{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*",
      "vulnerable": true
    }
  ],
  "operator": "OR"
}

Source: nvd