# CVE-2021-42013

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

- Page: https://www.vulneraibility.com/cve/CVE-2021-42013
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2021-11-03; CISA due date 2021-11-17; known ransomware use
- EPSS: 99.96% (percentile 100.0)
- Public exploit code: 3 on Exploit-DB · 2 Metasploit modules · 37 GitHub proofs of concept · 1 Nuclei template (first 2021-10-07)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-02-04)
- Weakness: CWE-22
- Published: 2021-10-07

## Affected versions

- Apache Software Foundation Apache HTTP Server: affected Apache HTTP Server 2.4.49; Apache HTTP Server 2.4.50

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://httpd.apache.org/security/vulnerabilities_24.html
- [other] https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E
- [other] https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E
- [other] http://www.openwall.com/lists/oss-security/2021/10/07/6
- [advisory] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ
- [advisory] http://jvn.jp/en/jp/JVN51106450/index.html
- [other] http://www.openwall.com/lists/oss-security/2021/10/08/1
- [other] https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E
- [other] http://www.openwall.com/lists/oss-security/2021/10/08/2
- [other] http://www.openwall.com/lists/oss-security/2021/10/08/3
- [other] http://www.openwall.com/lists/oss-security/2021/10/08/4
- [other] http://www.openwall.com/lists/oss-security/2021/10/08/6
- [other] http://www.openwall.com/lists/oss-security/2021/10/08/5
- [other] http://www.openwall.com/lists/oss-security/2021/10/09/1
- [other] http://www.openwall.com/lists/oss-security/2021/10/11/4
- [advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/
- [advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/
- [other] http://www.openwall.com/lists/oss-security/2021/10/15/3
- [other] http://www.openwall.com/lists/oss-security/2021/10/16/1
- [other] https://www.oracle.com/security-alerts/cpujan2022.html
- [other] https://security.netapp.com/advisory/ntap-20211029-0009/
- [other] http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html
- [other] http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html
- [other] http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html
- [other] http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html
- [other] http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html
- [other] https://www.oracle.com/security-alerts/cpuapr2022.html
- [other] http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html
- [other] https://www.povilaika.com/apache-2-4-50-exploit/
- [advisory] https://security.gentoo.org/glsa/202208-20
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42013

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.