CVE-2021-41773 – CVE-2021-41773 is a path traversal vulnerabilit... (How to Fix)

Q: What is the severity of CVE-2021-41773?

CVE-2021-41773 has a CVSS score of 9.8 (CRITICAL). CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows attackers to access files outside configured directories. If CGI is enabled, this can lead to remote code execution. Only Apache 2.4.49 is affected, though the initial fix in 2.4.50 was incomplete.

📋 TL;DR

CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows attackers to access files outside configured directories. If CGI is enabled, this can lead to remote code execution. Only Apache 2.4.49 is affected, though the initial fix in 2.4.50 was incomplete.

💻 Affected Systems

Products:

Apache HTTP Server

Versions: 2.4.49 only

Operating Systems: All operating systems running Apache

Default Config Vulnerable: ⚠️ Yes

Notes: Requires specific configurations where files outside aliased directories are not protected by 'require all denied' and CGI is enabled for those paths.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with full system compromise if CGI scripts are enabled and files outside aliased directories are accessible.

🟠

Likely Case

Unauthorized file access and potential information disclosure from web server directories.

🟢

If Mitigated

Limited impact if 'require all denied' is properly configured and CGI is disabled for aliased paths.

🌐 Internet-Facing: HIGH - This affects web servers directly exposed to the internet with known public exploits.

🏢 Internal Only: MEDIUM - Internal servers are still vulnerable but have reduced attack surface compared to internet-facing systems.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Multiple public exploit scripts exist and active exploitation has been observed in the wild.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.4.50 (though incomplete, see CVE-2021-42013) and 2.4.51 for complete fix

Vendor Advisory: https://httpd.apache.org/security/vulnerabilities_24.html

Restart Required: Yes

Instructions:

1. Backup current configuration. 2. Download Apache 2.4.51 or later from official sources. 3. Stop Apache service. 4. Install updated version. 5. Restart Apache service. 6. Verify version with 'httpd -v'.

🔧 Temporary Workarounds

Disable CGI for aliased paths

all

Prevent remote code execution by disabling CGI execution for vulnerable path configurations

# In httpd.conf or appropriate config file, ensure: Options -ExecCGI
# For specific directories: <Directory "/path/to/aliased"> Options -ExecCGI </Directory>

Implement strict access controls

all

Ensure all directories outside aliased paths have 'require all denied'

# In httpd.conf: <Directory /> Require all denied </Directory>
# Then explicitly allow only necessary directories

🧯 If You Can't Patch

Immediately upgrade to Apache 2.4.51 or later - this is critical due to active exploitation
If immediate upgrade is impossible, implement network segmentation and restrict access to affected servers while planning upgrade

🔍 How to Verify

Check if Vulnerable:

Check Apache version with 'httpd -v' or 'apache2 -v'. If version is exactly 2.4.49, the system is vulnerable.

Check Version:

httpd -v 2>/dev/null || apache2 -v 2>/dev/null || apachectl -v 2>/dev/null

Verify Fix Applied:

After patching, verify version is 2.4.51 or later with 'httpd -v'. Test with known exploit payloads to confirm they no longer work.

📡 Detection & Monitoring

Log Indicators:

Unusual URL patterns with '../' sequences in access logs
Requests to unexpected file paths outside normal web directories
Failed CGI execution attempts in error logs

Network Indicators:

HTTP requests containing encoded path traversal sequences like %2e%2e%2f
Unusual file retrieval patterns from web server

SIEM Query:

source="apache_access" AND (uri="*%2e%2e%2f*" OR uri="*..%2f*" OR uri="*../*")

📊 Metadata

CVE ID: CVE-2021-41773

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-22

Published: October 5, 2021

Last Updated: February 17, 2026

🔗 References

http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
http://www.openwall.com/lists/oss-security/2021/10/05/2 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/07/1 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/07/6 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/1 Exploit,Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/2 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/3 Exploit,Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/4 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/5 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/6 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/09/1 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/11/4 Mailing List,Patch,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/15/3 Mailing List,Patch,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/16/1 Mailing List,Third Party Advisory
https://httpd.apache.org/security/vulnerabilities_24.html Release Notes,Vendor Advisory
https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E Mailing List,Patch
https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/ Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/ Release Notes
https://security.gentoo.org/glsa/202208-20 Third Party Advisory
https://security.netapp.com/advisory/ntap-20211029-0009/ Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
http://www.openwall.com/lists/oss-security/2021/10/05/2 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/07/1 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/07/6 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/1 Exploit,Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/2 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/3 Exploit,Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/4 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/5 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/6 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/09/1 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/11/4 Mailing List,Patch,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/15/3 Mailing List,Patch,Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/16/1 Mailing List,Third Party Advisory
https://httpd.apache.org/security/vulnerabilities_24.html Release Notes,Vendor Advisory
https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E Mailing List,Patch
https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.httpd.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/ Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/ Release Notes
https://security.gentoo.org/glsa/202208-20 Third Party Advisory
https://security.netapp.com/advisory/ntap-20211029-0009/ Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773 US Government Resource

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-41773, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Cloud Backup by Netapp

Fedora by Fedoraproject

Fedora by Fedoraproject

Http Server by Apache

Instantis Enterprisetrack by Oracle

Instantis Enterprisetrack by Oracle

Instantis Enterprisetrack by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable CGI for aliased paths

Implement strict access controls

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities