Advisory details:
vulnrichment / CVE-2021-42013
| Advisory ID | vulnrichment/CVE-2021-42013 |
| Aliases | |
| Summary | It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 9.8 | |
| ssvc | Act |
| Data source | Exploit-DB |
|---|---|
| Date added | Oct. 13, 2021 |
| Description | Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE) |
| Ransomware campaign use | Known |
| Source publication date | Oct. 13, 2021 |
| Exploit type | webapps |
| Platform | multiple |
| Source update date | Oct. 13, 2021 |
| Data source | Metasploit |
|---|---|
| Description | This module scans for an unauthenticated RCE vulnerability which exists in Apache version 2.4.49 (CVE-2021-41773). If files outside of the document root are not protected by 'require all denied' and CGI has been explicitly enabled, it can be used to execute arbitrary commands (Remote Command Execution). This vulnerability has been reintroduced in Apache 2.4.50 fix (CVE-2021-42013). |
| Note | Stability: - crash-safe Reliability: - repeatable-session SideEffects: - ioc-in-logs - artifacts-on-disk |
| Ransomware campaign use | Unknown |
| Source publication date | May 10, 2021 |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/scanner/http/apache_normalize_path.rb |
| Data source | Metasploit |
|---|---|
| Description | This module exploit an unauthenticated RCE vulnerability which exists in Apache version 2.4.49 (CVE-2021-41773). If files outside of the document root are not protected by 'require all denied' and CGI has been explicitly enabled, it can be used to execute arbitrary commands (Remote Command Execution). This vulnerability has been reintroduced in Apache 2.4.50 fix (CVE-2021-42013). |
| Note | Stability: - crash-safe Reliability: - repeatable-session SideEffects: - ioc-in-logs - artifacts-on-disk |
| Ransomware campaign use | Unknown |
| Source publication date | May 10, 2021 |
| Platform | Linux,Unix |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/apache_normalize_path_rce.rb |
| Data source | KEV |
|---|---|
| Date added | Nov. 3, 2021 |
| Description | Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773. |
| Required action | Apply updates per vendor instructions. |
| Due date | Nov. 17, 2021 |
| Note | https://nvd.nist.gov/vuln/detail/CVE-2021-42013 |
| Ransomware campaign use | Known |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:28:39Z/
Decision: Act
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2021/42xxx/CVE-2021-42013.json
Source Advisory: vulnrichment/CVE-2021-42013
[{'Exploitation': 'active'},
{'Automatable': 'yes'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]