CVE-2021-42013— Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
Quick assessment
Affected
Apache Software Foundation Apache HTTP Server
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache HTTP Server是美国阿帕奇（Apache）基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点。 Apache HTTP Server 存在安全漏洞，该漏洞源于发现 Apache HTTP Server 2.4.50 版本中对 CVE-2021-41773 的修复不够充分。攻击者可以使用路径遍历攻击将 URL 映射到由类似别名的指令配置的目录之外的文件。如果这些目录之外的文件不受通常的默认配置“要求全部拒绝”的保护，则这些请求可能会成功。如果还为这些别
Public Exploits 6
Metasploit · 2
apache_normalize_path_rce.rb#CVE-2021-42013 [exploit]
apache_normalize_path.rb#CVE-2021-42013 [auxiliary]
Nuclei · 1
CVE-2021-42013.yaml [template]
In-the-Wild Activity Observed
cisa_kev · confirmed
Possible ATT&CK Techniques 3 AI
T1068 · Exploitation for Privilege Escalation T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-42013
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
Source: CVE Program / CVE List V5
Vulnerability Description
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache HTTP Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache HTTP Server是美国阿帕奇（Apache）基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点。 Apache HTTP Server 存在安全漏洞，该漏洞源于发现 Apache HTTP Server 2.4.50 版本中对 CVE-2021-41773 的修复不够充分。攻击者可以使用路径遍历攻击将 URL 映射到由类似别名的指令配置的目录之外的文件。如果这些目录之外的文件不受通常的默认配置“要求全部拒绝”的保护，则这些请求可能会成功。如果还为这些别
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server | Apache HTTP Server 2.4.49 | - |
|
II. Public POCs for CVE-2021-42013
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Exploit with integrated shodan search | https://github.com/andrea-mattioli/apache-exploit-CVE-2021-42013 | POC Details |
| 2 | Apache 2.4.50 Path traversal vulnerability | https://github.com/Vulnmachines/cve-2021-42013 | POC Details |
| 3 | Docker container lab to play/learn with CVE-2021-42013 | https://github.com/twseptian/cve-2021-42013-docker-lab | POC Details |
| 4 | None | https://github.com/LayarKacaSiber/CVE-2021-42013 | POC Details |
| 5 | Poc CVE-2021-42013 - Apache 2.4.50 without CGI | https://github.com/TheLastVvV/CVE-2021-42013 | POC Details |
| 6 | PoC CVE-2021-42013 reverse shell Apache 2.4.50 with CGI | https://github.com/TheLastVvV/CVE-2021-42013_Reverse-Shell | POC Details |
| 7 | cve-2021-42013.py is a python script that will help in finding Path Traversal or Remote Code Execution vulnerability in Apache 2.4.50 | https://github.com/walnutsecurity/cve-2021-42013 | POC Details |
| 8 | Exploit Apache 2.4.50(CVE-2021-42013) | https://github.com/robotsense1337/CVE-2021-42013 | POC Details |
| 9 | None | https://github.com/xMohamed0/CVE-2021-42013-ApacheRCE | POC Details |
| 10 | Apache 远程代码执行 （CVE-2021-42013）批量检测工具：Apache HTTP Server是美国阿帕奇（Apache）基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点，发现 Apache HTTP Server 2.4.50 中针对 CVE-2021-41773 的修复不够充分。攻击者可以使用路径遍历攻击将 URL 映射到由类似别名的指令配置的目录之外的文件。如果这些目录之外的文件不受通常的默认配置“要求全部拒绝”的保护，则这些请求可能会成功。如果还为这些别名路径启用了 CGI 脚本，则这可能允许远程代码执行。此问题仅影响 Apache 2.4.49 和 Apache 2.4.50，而不影响更早版本。 | https://github.com/asaotomo/CVE-2021-42013-Apache-RCE-Poc-Exp | POC Details |
| 11 | CVE-2021-42013-exp | https://github.com/rnsss/CVE-2021-42013 | POC Details |
| 12 | Apache HTTP Server 2.4.50 - RCE Lab | https://github.com/jas9reet/CVE-2021-42013-LAB | POC Details |
| 13 | These Nmap, Python and Ruby scripts detects and exploits CVE-2021-42013 with RCE and local file disclosure. | https://github.com/mauricelambert/CVE-2021-42013 | POC Details |
| 14 | None | https://github.com/honypot/CVE-2021-42013 | POC Details |
| 15 | None | https://github.com/Adashz/CVE-2021-42013 | POC Details |
| 16 | CVE-2021-42013 - Apache 2.4.50 | https://github.com/hadrian3689/apache_2.4.50 | POC Details |
| 17 | Exploit for Apache 2.4.50 (CVE-2021-42013) | https://github.com/viliuspovilaika/cve-2021-42013 | POC Details |
| 18 | Apache 2.4.49-50 Remote Code Execution Exploit | https://github.com/theykillmeslowly/CVE-2021-42013 | POC Details |
| 19 | None | https://github.com/mightysai1997/cve-2021-42013 | POC Details |
| 20 | None | https://github.com/mightysai1997/cve-2021-42013L | POC Details |
| 21 | None | https://github.com/mightysai1997/cve-2021-42013.get | POC Details |
| 22 | Vulnerable configuration Apache HTTP Server version 2.4.49/2.4.50 | https://github.com/12345qwert123456/CVE-2021-42013 | POC Details |
| 23 | CVE: 2021-42013 Tested on: 2.4.49 and 2.4.50 Description: Path Traversal or Remote Code Execution vulnerabilities in Apache 2.4.49 and 2.4.50 | https://github.com/cybfar/cve-2021-42013-httpd | POC Details |
| 24 | Exploring CVE-2021-42013, using Suricata and OpenVAS to gather info | https://github.com/vudala/CVE-2021-42013 | POC Details |
| 25 | Apache 2.4.50 Automated Remote Code Execution and Path traversal | https://github.com/birdlinux/CVE-2021-42013 | POC Details |
| 26 | None | https://github.com/Hamesawian/CVE-2021-42013 | POC Details |
| 27 | A PoC exploit for CVE-2021-42013 - Apache 2.4.49 & 2.4.50 Remote Code Execution | https://github.com/K3ysTr0K3R/CVE-2021-42013-EXPLOIT | POC Details |
| 28 | Apache 2.4.50 - Path Traversal or Remote Code Execution | https://github.com/Rubikcuv5/cve-2021-42013 | POC Details |
| 29 | None | https://github.com/imhunterand/CVE-2021-42013 | POC Details |
| 30 | CVE-2021-42013 Vulnerability Scanner This Python script checks for the Remote Code Execution (RCE) vulnerability (CVE-2021-42013) in Apache 2.4.50. | https://github.com/BassoNicolas/CVE-2021-42013 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-42013
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-42013 (7)
-
https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
-
https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
-
https://security.netapp.com/advisory/ntap-20211029-0009/ x_refsource_CONFIRM
-
-
🔗 Apache HTTPD: Multiple Vulnerabilities (GLSA 202208-20) — Gentoo security Read full article vendor-advisory x_refsource_GENTOO
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ vendor-advisory x_refsource_CISCO
Exploits & Public PoCs for CVE-2021-42013 (6)
Mailing List Discussions for CVE-2021-42013 (14)
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/ vendor-advisory x_refsource_FEDORA
-
https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E mailing-list x_refsource_MLIST
-
https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E mailing-list x_refsource_MLIST
-
-
-
-
-
-
-
-
-
-
Other References for CVE-2021-42013 (1)
-
https://www.povilaika.com/apache-2-4-50-exploit/ x_refsource_MISC
Same Patch Batch · Apache Software Foundation · 2021-10-07 · 3 CVEs total
| CVE-2021-28129 | DEB packaging for Apache OpenOffice 4.1.8 installed with a non-root userid and groupid | |
| CVE-2021-40439 | Billion Laughs |
IV. Related Vulnerabilities
Same product: Apache HTTP Server
-
CVE-2026-49975
Apache HTTP Server: mod_http2 denial of service -
CVE-2026-48913
Apache HTTP Server: mod_http2 memory corruption when file ha -
CVE-2026-42536
Apache HTTP Server: mod_xml2enc heap overflow -
CVE-2026-44185
Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP ` -
CVE-2026-34355
Apache HTTP Server: mod_proxy_html buffer overflow
Same vendor: Apache Software Foundation
-
CVE-2026-73180
Apache Tomcat: Authenticated WebSocket session survives end -
CVE-2026-68763
Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tra -
CVE-2026-68569
Apache Tomcat: Principal lookup can fail open in some cases -
CVE-2026-68525
Apache Tomcat: Redirect after FORM auth may bypass method sp -
CVE-2026-66422
Apache Tomcat: Servlet role references can bypass declarativ
Same weakness: CWE-22
-
CVE-2026-57171
Trestle is vulnerable to arbitrary file write via path trave -
CVE-2026-32637
Velero vulnerable to file path traversal when extracting fro -
CVE-2026-80104
DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill U -
CVE-2026-65092
NVIDIA OpenShell Sandbox路径穿越绕过导致信息泄露 -
CVE-2026-55557
browse-mcp: Arbitrary file write via unconfined download and
V. Comments for CVE-2021-42013
No comments yet