Apache Patches Path Traversal Zero-Day in HTTP Server

Apache has released emergency patches for a path traversal vulnerability in its HTTP Server that is already being actively exploited in the wild. Tracked as CVE-2021-41773, the flaw affects version 2.4.49 and, in certain configurations, can allow an attacker to read arbitrary files or even execute remote code on the underlying system. Both Linux and Windows deployments are vulnerable.

The Apache Security team was first alerted to the issue on September 29, 2021. An initial fix shipped on October 4 as version 2.4.50, but that proved incomplete and required a follow-up patch on October 7, bumping the server to version 2.4.51 and adding CVE-2021-42013 to cover the incomplete fix. Any organization running 2.4.49 or 2.4.50 should update to 2.4.51 immediately.

Root Cause: Incomplete URL Normalization

The vulnerability stems from missing path normalization logic in Apache's URL handling. When a server is not configured with a require all denied directive for files outside the document root, an attacker can craft a URL that escapes the web root and reads any file accessible by the Apache process. The flaw can also be abused to leak the source code of interpreted files such as CGI scripts, and in some scenarios enable full server takeover through shell script execution.

A straightforward attack path looks like this:

$hostname/cgi-bin/../../../etc/passwd

Here the ../ sequences climb the directory tree out of the document root before reaching /etc/passwd. Correctly implemented normalization logic would collapse the path to $hostname/etc/passwd, rendering the traversal attempt ineffective.

Proper normalization is complicated by character encoding. The same traversal can be delivered using percent-encoded dots:

$hostname/cgi-bin/.%2e/%2e%2e/%2e%2e/etc/passwd

Since %2e decodes to ., the two URLs are functionally identical. Apache's failure to handle this encoding variant consistently is what left the door open for attackers.

Protection Mechanisms

Cloudflare customers with the "normalize URLs to origin" setting enabled have been protected against this vulnerability from the start. For customers with access to the Cloudflare Web Application Firewall (WAF), additional rules are available to block exploit attempts:

  • New WAF rule IDs: 1c3d3022129c48e9bb52e953fe8ceb2f, ca955959c4ab4b1f84f681a4d0a5c982
  • Legacy WAF rule IDs: 100045, 100045A

The rules are identifiable by the messages "Anomaly:URL:Query String - Multiple Slashes, Relative Paths, CR, LF or NULL" and "Anomaly:URL:Path - Multiple Slashes, Relative Paths, CR, LF or NULL." Given that attackers typically target sensitive files like /etc/passwd, many other Cloudflare Managed Rule signatures are also effective at stopping exploit attempts depending on which file is being accessed.

Observed Exploitation Activity

Cloudflare has tracked a sharp uptick in exploit attempts and server scanning since October 5. The bulk of activity has been probing for static file paths, indicating that scanners are sweeping the internet for vulnerable servers. The most commonly attempted file paths have been documented, suggesting that attackers may be using them before moving to more advanced techniques that could lead to remote code execution.

/cgi-bin/.%2e/.git/config
/cgi-bin/.%2e/app/etc/local.xml
/cgi-bin/.%2e/app/etc/env.php
/cgi-bin/.%2e/%2e%2e/%2e%2e/etc/passwd

Mitigation Strategy

The immediate priority is patching to Apache HTTP Server 2.4.51. Details on the update are available from the official Apache HTTP Server project site. Beyond applying patches, standard defense measures such as URL normalization and WAF rules can provide an important buffer while incident response teams work through their remediation plans. These measures give operators time to deploy vendor patches without having to take services offline or leave them exposed in the interim.