Apache HTTP Server Path Traversal and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2021-42013)
Executive & SecOps Summary
SECOPS ASSESSMENTApache HTTP Server versions 2.4.49 and 2.4.50
Unauthenticated remote attackers can exploit this vulnerability to access sensitive files outside the document root or execute arbitrary commands if CGI scripts are enabled
Immediately upgrade Apache HTTP Server to version 2.4.51 or later, and enforce strict directory access controls
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade Apache HTTP Server to version 2.4.51 or later immediately.
# For Debian/Ubuntu-based systems
sudo apt-get update
sudo apt-get install --only-upgrade apache2 -y
# For RedHat/CentOS-based systems
sudo yum update httpd -y2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, modify the Apache configuration file (httpd.conf or apache2.conf) to explicitly deny access to the root directory.
# Open httpd.conf or apache2.conf and ensure the default directory block is secure
<Directory />
AllowOverride none
Require all denied
</Directory>
# Restart the Apache service to apply changes
sudo systemctl restart apache2 # Debian/Ubuntu
sudo systemctl restart httpd # RHEL/CentOS3. Log Audit & IoC Verification Commands
Use the following commands to inspect web server access logs for double-encoding traversal attempts and verify the running Apache version.
# Search access logs for double-encoded traversal patterns and CGI execution attempts
grep -E '%%32%65|%2e%2e|cgi-bin' /var/log/apache2/access.log /var/log/httpd/access_log 2>/dev/null
# Check the current installed version of Apache HTTP Server
apache2 -v 2>/dev/null || httpd -vBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-42013) is a bypass of the initial fix introduced for CVE-2021-41773 in Apache HTTP Server 2.4.50. The root cause lies in an insufficient normalization logic of URL paths. While the server attempts to filter out standard dot-dot-slash ('..') sequences, it fails to properly handle double URL-encoded representations. Attackers can craft requests using double-encoded characters such as '%2e%2e%2f' or '%%32%65%%32%65%%33%66' to bypass the path traversal protection mechanism, allowing them to map URLs to files outside the configured document root.
2. Exploitation Mechanics & Attack Scenario
The exploitation relies on the presence of Alias-like directives (e.g., Alias, ScriptAlias) that map URLs to specific file system directories.
- Path Traversal: An attacker sends a crafted HTTP request containing double-encoded traversal sequences (e.g., 'http://target/icons/%%32%65%%32%65/%%32%65%%32%65/etc/passwd'). If the target directories outside the alias are not protected by the default 'require all denied' configuration, the server returns the contents of the requested system files.
- Remote Code Execution (RCE): If the mod_cgi module is enabled and the traversed path points to an executable binary (such as '/bin/sh'), the attacker can send a POST request containing shell commands in the request body, resulting in arbitrary command execution under the privileges of the Apache daemon process.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and active exploitation observed in the wild (CISA KEV), this vulnerability poses an extreme risk to enterprise infrastructure. Successful exploitation allows unauthenticated remote code execution, which can lead to full system compromise, lateral movement within the internal network, data exfiltration, and deployment of ransomware or web shells.
Official Vendor Advisories & References
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
Frequently Asked SecOps Questions (CVE-2021-42013)
FAQQ1. How critical is CVE-2021-42013 and is it actively exploited in the wild?
CVE-2021-42013 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-42013?
Primary impacted vendors include apache across http_server. Scope summary: Apache HTTP Server versions 2.4.49 and 2.4.50 only (earlier versions are not affected)
Q3. What temporary mitigations or workarounds exist for CVE-2021-42013 before patching?
[Mitigation] Immediately upgrade Apache HTTP Server to version 2.4.51 or later, and enforce strict directory access controls Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-42013
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (apache)
View Category →Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Apache Tomcat EncryptInterceptor Bypass and Sensitive Data Exposure Vulnerability (CVE-2026-34486)
[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled
Apache Tomcat EncryptInterceptor Padding Oracle Vulnerability (CVE-2026-29146) Security Advisory
[Affected Scope] Apache Tomcat deployments utilizing `EncryptInterceptor` with default configurations for cluster membership protection (11.0.0-M1 to 11.0.18, 10.0.0-M1 to 10.1.52, 9.0.13 to 9.0.115, 8.5.38 to 8.5.100, 7.0.100 to 7.0.109).
Adobe ColdFusion Path Traversal Remote Code Execution Vulnerability Urgent Advisory (CVE-2026-48282)
[Affected Scope] Adobe ColdFusion versions 2025.9, 2023.20 and earlier
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.