InfraFenceInfraFence

Live Security Operations

Get Started

CVE-2021-42013: Apache 2.4.50 path traversal, check and fix

Last updated:

Apache HTTP Server 2.4.50 fixed CVE-2021-41773, but not completely: encoding the dot twice (%%32%65, where %32 is 2 and %65 is e) still walked out of the mapped folders. It affects 2.4.49 and 2.4.50, with the same results: files outside the document root, and code execution where CGI is enabled.

Apache fixed it in 2.4.51, released three days after 2.4.50.

At a glance

CVE
CVE-2021-42013
Software
Apache HTTP Server
Affected versions
2.4.49 and 2.4.50
Fixed in
2.4.51
CVSS score
9.8 Critical (NVD, CVSS 3.1) · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known Exploited Vulnerabilities
Yes, added on November 3, 2021
Published by NVD
October 7, 2021
InfraFence virtual patch
vp-cve-2021-42013 (ModSecurity id 9920002)

What is affected

Apache 2.4.49 and 2.4.50 only. As for CVE-2021-41773, files are exposed where <Directory /> does not keep the default Require all denied, and code runs where mod_cgi or mod_cgid serves an aliased folder such as /cgi-bin/.

Check whether a server is vulnerable

Check the version:

Debian / Ubuntu
apache2 -v
RHEL family
httpd -v
Built from source (default prefix)
/usr/local/apache2/bin/httpd -v

On 2.4.49 or 2.4.50, check that the file system root denies access and whether a CGI module is loaded:

Any distribution
sudo grep -rn -A3 '<Directory />' /etc/apache2/ /etc/httpd/ /usr/local/apache2/conf/ 2>/dev/null
Any distribution
sudo apachectl -M 2>/dev/null | grep -i cgi

Attempts leave encoded dots in the access logs:

Apache access logs
sudo grep -rhiE '\.%2e/|%2e\./|%2e%2e/|%%32%65|\.%%32' --include='*access*' --exclude='*.gz' /var/log/apache2 /var/log/httpd 2>/dev/null | tail -20

Fix it

Upgrade to 2.4.51 or later (the upgrade restarts Apache, so pick a quiet moment):

Debian / Ubuntu
sudo apt-get update
sudo apt-get install --only-upgrade apache2
apache2 -v
RHEL family
sudo dnf upgrade httpd
httpd -v

Rebuild a source install from the current 2.4 release, or pull a new container image. Keep the file system root closed and reload:

httpd.conf / apache2.conf
<Directory />
    AllowOverride None
    Require all denied
</Directory>
Any distribution
sudo apachectl configtest && sudo apachectl graceful

Warning: Successful requests (status 200) with double-encoded dots in the logs mean files may have been read and, with CGI, commands run: investigate the server before you trust it again.

How InfraFence blocks it while you update

The virtual patch for CVE-2021-42013 is a ModSecurity rule on the raw path of the request: it blocks the double-encoded dot (%%32%65, %%32e, .%%32, %2%65). Apply it together with the patch for CVE-2021-41773, which blocks the single-encoded form.

How the patch is applied

  1. The agent notes which SSH ports and sites answer.
  2. It writes the rule (ModSecurity id 9920002) between its own markers in its ModSecurity file, runs apachectl configtest and reloads Apache gracefully. A failed test puts the previous file back.
  3. It checks that SSH and the sites still answer, and removes the patch if they do not.
  4. It checks that ModSecurity really blocks with the rule, with a harmless local probe request. A ModSecurity in DetectionOnly only logs: the patch is then removed and reported as ineffective, never as applied.

Every request the patch blocks is reported with CVE-2021-42013 (agent 1.0.37 or later): you see the attempts on the server's activity and on the Exploitation page of the dashboard, so you know the vulnerability is being tried against you.

Warning: A virtual patch blocks the known form of the attack on the requests that go through Apache on that server. It is not a substitute for the update: install the fixed version, then remove the patch from Activity with Undo if you no longer need it.

Virtual patches need Apache with ModSecurity, the setting Allow web server configuration changes, and no hosting panel or configuration manager in charge of the web server; they are part of the Pro plan and AutoMode. A person applies them from the AI analysis, or AutoMode does. See Virtual patches.

Sources

The facts on this page come from these sources; check them for changes.

Try it free on 1 server

Starter is free for one server, with full protection and automatic blocking. No credit card.

Install the agent as root, with your token in place of <TOKEN>:

curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --token <TOKEN>

The token is created in the dashboard, in Servers › Add server.

Create a free accountRead the docs