CVE-2021-42013 — Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

Description

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache HTTP Server	Apache HTTP Server 2.4.49, Apache HTTP Server 2.4.50	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	apache2	2.4.51-1	—
Debian 13	apache2	2.4.51-1	—
Debian 12	apache2	2.4.51-1	—

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	apache2	2.4.51-1.1	openSUSE-SU-2024:11560-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	apache2	2.4.51-r0	—
Alpine v3.23	apache2	2.4.51-r0	—
Alpine v3.22	apache2	2.4.51-r0	—
Alpine v3.21	apache2	2.4.51-r0	—
Alpine v3.20	apache2	2.4.51-r0	—

Show 9 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	apache2	2.4.51-r0	—
Alpine v3.18	apache2	2.4.51-r0	—
Alpine v3.17	apache2	2.4.51-r0	—
Alpine v3.16	apache2	2.4.51-r0	—
Alpine v3.15	apache2	2.4.51-r0	—
Alpine v3.14	apache2	2.4.51-r0	—
Alpine v3.13	apache2	2.4.51-r0	—
Alpine v3.12	apache2	2.4.51-r0	—
Alpine v3.11	apache2	2.4.51-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	httpd +7	2.4.51-1.amzn2	ALAS2-2021-1716
Amazon Linux 2	mod_ssl +1	1:2.4.51-1.amzn2	ALAS2-2021-1716

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 2 modules

Apache 2.4.49/2.4.50 Traversal RCE scanner
auxiliary/scanner/http/apache_normalize_path
Apache 2.4.49/2.4.50 Traversal RCE
exploit/multi/http/apache_normalize_path_rce

Exploit-DB 3

Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3) EDB-50512 · webapps · Nov 11, 2021 · verified
Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (2) EDB-50446 · webapps · Oct 25, 2021
Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE) EDB-50406 · webapps · Oct 13, 2021 · verified

GitHub 38 repositories · most starred shown

walnutsecurity/cve-2021-42013 ★ 30 · Oct 27, 2021

cve-2021-42013.py is a python script that will help in finding Path Traversal or Remote Code Execution vulnerability in Apache 2.4.50
Vulnmachines/cve-2021-42013 ★ 16 · Oct 8, 2021

Apache 2.4.50 Path traversal vulnerability
asaotomo/CVE-2021-42013-Apache-RCE-Poc-Exp ★ 10 · Dec 23, 2021

Apache 远程代码执行（CVE-2021-42013）批量检测工具：Apache HTTP Server是美国阿帕奇（Apache）基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点，发现 Apache HTTP Server 2.4.50 中针对 CVE-2021-41773 的修复不够充分。攻击者可以使用路径遍历攻击将 URL 映射到由类似别名的指令配…
andrea-mattioli/apache-exploit-CVE-2021-42013 ★ 9 · Oct 7, 2021

Exploit with integrated shodan search
TheLastVvV/CVE-2021-42013_Reverse-Shell ★ 7 · Oct 24, 2021

PoC CVE-2021-42013 reverse shell Apache 2.4.50 with CGI
BassoNicolas/CVE-2021-42013 ★ 3 · Apr 7, 2024

CVE-2021-42013 Vulnerability Scanner This Python script checks for the Remote Code Execution (RCE) vulnerability (CVE-2021-42013) in Apache 2.4.50.
TheLastVvV/CVE-2021-42013 ★ 2 · Oct 23, 2021

Poc CVE-2021-42013 - Apache 2.4.50 without CGI
twseptian/cve-2021-42013-docker-lab ★ 2 · Oct 14, 2021

Docker container lab to play/learn with CVE-2021-42013
jas9reet/CVE-2021-42013-LAB ★ 1 · Feb 3, 2022

Apache HTTP Server 2.4.50 - RCE Lab
robotsense1337/CVE-2021-42013 ★ 1 · Nov 3, 2021

Exploit Apache 2.4.50(CVE-2021-42013)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution http/cves/2021/CVE-2021-42013.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Advisories 3

openSUSE-SU-2024:11560-1 apache2-2.4.51-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
ALAS2-2021-1716 Important: httpd security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 15, 2021

EUVD	v3.1	9.8
CISA-ADP	v3.1	9.8

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

Description

Affected products

Fixed in Linux distributions

Debian

openSUSE

Alpine

Amazon Linux

Public exploits

Metasploit 2 modules

Exploit-DB 3

GitHub 38 repositories · most starred shown

Automated scanner template

Advisories 3

References