InfraFenceInfraFence

Live Security Operations

Get Started

CVE-2021-41773: Apache 2.4.49 path traversal, check and fix

Last updated:

Apache HTTP Server 2.4.49 changed how it normalizes paths, and the change let an encoded dot (%2e) slip through. A request with .%2e/ segments in its path could then reach files outside the folders the configuration maps. With CGI enabled on such a folder, the same trick runs programs on the server.

Only version 2.4.49 is affected. Its fix, 2.4.50, was itself incomplete (CVE-2021-42013), so the version to run is 2.4.51 or later.

At a glance

CVE
CVE-2021-41773
Software
Apache HTTP Server
Affected versions
2.4.49 only
Fixed in
2.4.50 (incomplete, see CVE-2021-42013); upgrade to 2.4.51 or later
CVSS score
9.8 Critical (NVD, CVSS 3.1) · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known Exploited Vulnerabilities
Yes, added on November 3, 2021
Published by NVD
October 5, 2021
InfraFence virtual patch
vp-cve-2021-41773 (ModSecurity id 9920001)

What is affected

Apache 2.4.49 was the current release for about three weeks, in September and October 2021. You find it today mostly on servers built from source, in container images of that time, or on systems that were not updated since. The file disclosure works only where files outside the mapped folders are not protected by the default Require all denied on <Directory />; code execution also needs CGI (mod_cgi or mod_cgid) on an aliased folder.

Check whether a server is vulnerable

Check the version first:

Debian / Ubuntu
apache2 -v
RHEL family
httpd -v
Built from source (default prefix)
/usr/local/apache2/bin/httpd -v

Anything other than Apache/2.4.49 or Apache/2.4.50 is not affected by this flaw. On those two versions, check the configuration of the file system root, which must deny access, and whether a CGI module is loaded:

Any distribution
sudo grep -rn -A3 '<Directory />' /etc/apache2/ /etc/httpd/ /usr/local/apache2/conf/ 2>/dev/null
Any distribution
sudo apachectl -M 2>/dev/null | grep -i cgi

Attempts leave encoded dots in the access logs:

Apache access logs
sudo grep -rhiE '\.%2e/|%2e\./|%2e%2e/|%%32%65|\.%%32' --include='*access*' --exclude='*.gz' /var/log/apache2 /var/log/httpd 2>/dev/null | tail -20

Fix it

Upgrade to 2.4.51 or later. With your distribution's package (the upgrade restarts Apache, so pick a quiet moment):

Debian / Ubuntu
sudo apt-get update
sudo apt-get install --only-upgrade apache2
apache2 -v
RHEL family
sudo dnf upgrade httpd
httpd -v

A server built from source needs a new build from the current 2.4 release; a container needs a new image. Then make sure the file system root denies access, as in the default configuration, and reload:

httpd.conf / apache2.conf
<Directory />
    AllowOverride None
    Require all denied
</Directory>
Any distribution
sudo apachectl configtest && sudo apachectl graceful

Warning: If the logs show successful requests (status 200) with encoded dots, treat the server as compromised: files such as /etc/passwd or configuration with passwords may have been read, and with CGI a program may have run.

How InfraFence blocks it while you update

The virtual patch for CVE-2021-41773 is a ModSecurity rule on the raw path of the request, before Apache decodes it: it blocks a path with an encoded dot next to a dot (.%2e, %2e., %2e%2e) followed by a slash, plain or encoded. Normal URLs never contain that sequence.

How the patch is applied

  1. The agent notes which SSH ports and sites answer.
  2. It writes the rule (ModSecurity id 9920001) between its own markers in its ModSecurity file, runs apachectl configtest and reloads Apache gracefully. A failed test puts the previous file back.
  3. It checks that SSH and the sites still answer, and removes the patch if they do not.
  4. It checks that ModSecurity really blocks with the rule, with a harmless local probe request. A ModSecurity in DetectionOnly only logs: the patch is then removed and reported as ineffective, never as applied.

Every request the patch blocks is reported with CVE-2021-41773 (agent 1.0.37 or later): you see the attempts on the server's activity and on the Exploitation page of the dashboard, so you know the vulnerability is being tried against you.

Warning: A virtual patch blocks the known form of the attack on the requests that go through Apache on that server. It is not a substitute for the update: install the fixed version, then remove the patch from Activity with Undo if you no longer need it.

Virtual patches need Apache with ModSecurity, the setting Allow web server configuration changes, and no hosting panel or configuration manager in charge of the web server; they are part of the Pro plan and AutoMode. A person applies them from the AI analysis, or AutoMode does. See Virtual patches.

Sources

The facts on this page come from these sources; check them for changes.

Try it free on 1 server

Starter is free for one server, with full protection and automatic blocking. No credit card.

Install the agent as root, with your token in place of <TOKEN>:

curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --token <TOKEN>

The token is created in the dashboard, in Servers › Add server.

Create a free accountRead the docs