CVE-2021-42013
CRITICALCVSS 9.8/10Actively ExploitedEPSS 99.96%
Last modified
CVE-2021-42013 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. CISA has confirmed active exploitation in the wild. EPSS estimates a 99.96% chance of exploitation in the next 30 days.
Description
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | 2.4.49 |
| Apache | Http Server | 2.4.50 |
| Fedoraproject | Fedora | 34 |
| Fedoraproject | Fedora | 35 |
| Oracle | Instantis Enterprisetrack | 17.1 |
| Oracle | Instantis Enterprisetrack | 17.2 |
| Oracle | Instantis Enterprisetrack | 17.3 |
| Oracle | Jd Edwards Enterpriseone Tools | < 9.2.6.0 |
| Oracle | Secure Backup | < 18.1.0.1.0 |
| Netapp | Cloud Backup | All versions |
References
- http://jvn.jp/en/jp/JVN51106450/index.htmlThird Party Advisory
- http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2021/10/07/6Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/1Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/2Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/3Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/4Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/5Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/6Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/09/1Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/11/4Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/15/3Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/16/1Mailing List, Third Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.htmlRelease Notes, Vendor Advisory
- https://security.gentoo.org/glsa/202208-20Third Party Advisory
- https://security.netapp.com/advisory/ntap-20211029-0009/Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
- https://www.povilaika.com/apache-2-4-50-exploit/Exploit, Third Party Advisory
- http://jvn.jp/en/jp/JVN51106450/index.htmlThird Party Advisory
- http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2021/10/07/6Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/1Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/2Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/3Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/4Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/5Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/08/6Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/09/1Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/11/4Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/15/3Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/10/16/1Mailing List, Third Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.htmlRelease Notes, Vendor Advisory
- https://security.gentoo.org/glsa/202208-20Third Party Advisory
- https://security.netapp.com/advisory/ntap-20211029-0009/Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
- https://www.povilaika.com/apache-2-4-50-exploit/Exploit, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42013US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2021-42013?
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
How severe is CVE-2021-42013?
CVE-2021-42013 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 99.96% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2021-42013?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-42008The decode_data function in drivers/net/hamradio/6pack.c in …7.8
- CVE-2021-42009An authenticated Apache Traffic Control Traffic Ops user wit…4.3
- CVE-2021-4201Missing access control in ForgeRock Access Management 7.1.0 …9.8
- CVE-2021-42010Heron versions <= 0.20.4-incubating allows CRLF log injectio…9.8
- CVE-2021-42011An incorrect permission assignment vulnerability in Trend Mi…7.8
- CVE-2021-42012A stack-based buffer overflow vulnerability in Trend Micro A…7.8
- CVE-2021-42015A vulnerability has been identified in Mendix Applications u…5.5
- CVE-2021-42016A vulnerability has been identified in RUGGEDCOM i800, RUGGE…7.5
- CVE-2021-42017A vulnerability has been identified in RUGGEDCOM i800, RUGGE…5.9
- CVE-2021-42018A vulnerability has been identified in RUGGEDCOM i800, RUGGE…5.9
- CVE-2021-42019A vulnerability has been identified in RUGGEDCOM i800, RUGGE…5.9
- CVE-2021-4202A use-after-free flaw was found in nci_request in net/nfc/nc…7
Are you affected by CVE-2021-42013?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST