CVE-2021-41773

What it actually does

Apache HTTP Server 2.4.49 contains a path normalization flaw that allows crafted URLs using encoded dot-dot path traversal sequences to escape Alias-like directory mappings and access files outside the intended web content directories. If filesystem permissions and Apache access controls do not explicitly deny access, an unauthenticated remote attacker can read arbitrary local files that the Apache process can access. If CGI is enabled for an affected aliased path, the same traversal primitive can be used to invoke executable files outside the intended CGI directory, enabling remote code execution with the privileges of the web server process. The originally released 2.4.50 fix was incomplete for the related issue CVE-2021-42013, so systems should be upgraded beyond 2.4.50.

Why it matters to the business

Successful exploitation can expose sensitive files such as credentials, application configuration, source code, private keys, and operating system data, and in CGI-enabled deployments can allow attackers to run commands on the server. Because this vulnerability is remotely exploitable without authentication, has a very high EPSS score, is listed in CISA KEV, has been used in ransomware campaigns, and has been exploited in the wild for years, any internet-facing Apache HTTP Server 2.4.49 instance should be treated as high-risk and remediated immediately.

How an attack unfolds

An attacker first identifies an Apache HTTP Server running version 2.4.49, typically by banner inspection, error pages, package metadata exposure, or broad internet scanning. They then send HTTP requests containing encoded traversal sequences such as /.%2e/ to bypass the flawed path normalization logic and resolve paths outside an aliased directory. For file disclosure, the attacker requests sensitive local files such as /etc/passwd, application configuration files, keys, or scripts and checks whether Apache returns their contents. If CGI is enabled and reachable through an affected alias, the attacker crafts a traversal request to a system executable or script and supplies command parameters, potentially achieving remote command execution as the Apache worker user. After gaining code execution or useful file disclosure, attackers commonly enumerate the host, harvest credentials, pivot to applications or adjacent systems, deploy web shells or malware, and in ransomware-driven campaigns use the foothold for broader compromise.

How to fix it

Upgrade Apache HTTP Server to 2.4.51 or later; do not rely on 2.4.50 as a final fix because the initial remediation was incomplete for a closely related bypass. If immediate upgrade is not possible, remove or disable vulnerable Alias-like mappings, disable CGI execution unless strictly required, and ensure every directory outside the intended document root is protected by explicit access controls such as 'Require all denied'. Review Apache configuration for overly broad Directory, Alias, ScriptAlias, and CGI settings. Restrict network exposure to trusted sources where feasible, place the service behind a filtering reverse proxy or WAF rule that blocks encoded traversal sequences, and rotate any secrets that may have been exposed through local file disclosure. For vendor-packaged products that embed Apache HTTP Server, apply the vendor-supplied security update rather than only updating the operating system package.

How to confirm the fix worked

Confirm the running Apache HTTP Server version is not 2.4.49 and is upgraded to 2.4.51 or later, or to a vendor backported build explicitly fixing this issue and the related incomplete-fix bypass. Validate with both package inventory and the actual running binary, for example by checking httpd/apache2 version output and service restart time. Review Apache configuration to confirm CGI is disabled where unnecessary and that filesystem locations outside the intended web roots have explicit deny rules. From a controlled test host, send benign traversal probes using encoded dot-dot sequences and verify the server returns 403 or 404 and does not disclose local file contents. Confirm WAF, reverse proxy, and web server logs show blocked traversal probes rather than successful 200 responses containing filesystem data.

Typical attack path

1. Scan for internet-facing Apache HTTP Server instances running version 2.4.49 or otherwise exhibiting vulnerable behavior.
2. Send crafted HTTP requests containing encoded traversal patterns such as /.%2e/ to test whether paths escape the configured web or alias directory.
3. Attempt to read proof files such as /etc/passwd or application configuration files to confirm arbitrary file disclosure.
4. If CGI is enabled, send traversal requests to invoke executable files or scripts and pass command parameters.
5. Use disclosed credentials, configuration secrets, or command execution to establish persistence, deploy tooling, or move laterally.
6. Cover tracks by blending requests into normal web traffic or rotating source infrastructure.

How to detect it

Review historical and current Apache access logs, reverse proxy logs, WAF logs, and load balancer logs for requests containing encoded path traversal payloads, especially sequences such as /.%2e/, %2e%2e, .%2e, or attempts to access /etc/passwd, /bin/sh, /bin/bash, /cgi-bin/, or application configuration files. Prioritize HTTP 200 responses, unusually large response sizes, or responses immediately followed by additional enumeration, file downloads, outbound connections, or authentication attempts. Review Apache error logs for malformed path, file-not-found, permission, or CGI execution errors involving traversal strings. If CGI was enabled, correlate web requests with endpoint process telemetry showing the Apache parent or worker process spawning shells, interpreters, network tools, or package download utilities. Look for post-exploitation artifacts such as unexpected files in web-writable directories, new cron jobs, suspicious temporary files, outbound connections to unknown IPs, added SSH keys, new local users, or ransomware staging behavior. Where threat-intelligence context is available, compare source IPs and payloads against known Apache path traversal exploitation campaigns, but do not rely on IP matching alone because exploitation has been widespread and opportunistic.

• /.%2e/
• /.%2e%2e/
• %2e%2e/
• .%2e/
• GET /cgi-bin/.%2e/
• POST /cgi-bin/.%2e/
• GET /icons/.%2e/
• GET /.%2e/.%2e/.%2e/.%2e/etc/passwd
• GET /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh
• GET /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/bash
• /etc/passwd
• /etc/shadow
• /bin/sh
• /bin/bash
• /cgi-bin/
• AH01215
• AH00128
• client denied by server configuration
• script not found or unable to stat
• apache2 spawned /bin/sh
• httpd spawned /bin/sh
• apache2 spawned /bin/bash
• httpd spawned /bin/bash
• curl http://
• wget http://
• /tmp/
• /var/tmp/

What your security team should do

• Immediately inventory all Apache HTTP Server deployments and prioritize any internet-facing or vendor-embedded instances running 2.4.49 for emergency remediation.
• Upgrade affected systems to Apache HTTP Server 2.4.51 or later, or apply vendor fixes that explicitly address this vulnerability and the related 2.4.50 bypass.
• Treat any exposed 2.4.49 server as potentially compromised; perform retrospective log review for traversal and CGI execution attempts before closing the incident.
• Disable CGI and ScriptAlias functionality unless business-critical, and harden Directory and Alias access controls with explicit deny-by-default rules.
• Search web access logs, error logs, EDR telemetry, and process execution data for exploitation patterns, especially requests containing encoded traversal sequences followed by suspicious shell commands.
• Rotate credentials, API keys, private keys, and application secrets stored on any server where file disclosure may have occurred.
• Deploy temporary WAF or reverse proxy detections for encoded traversal payloads while patching, but do not treat filtering as a substitute for upgrade.
• Because this vulnerability is in CISA KEV and has ransomware association, track remediation as an urgent risk item even though the original KEV due date has long passed.