CVE-2021-41773

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.49 through 2.4.50

Description A flaw in path normalization allows a path traversal attack to map URLs to files outside directories configured by Alias-like directives. If these files are not protected by the default "require all denied" configuration, requests can succeed. If CGI scripts are enabled for these paths, remote code execution may be possible. This issue has been exploited in the wild, with some reports indicating approximately 112,000 vulnerable hosts. Technical exploitation involves using encoded characters such as .%2e/ to access sensitive files like /etc/passwd or executing commands via /cgi-bin/.../bin/sh.

Recommendations Update Apache HTTP Server to a version later than 2.4.50. As a temporary workaround, ensure the "require all denied" configuration is applied to directories outside the intended alias paths. Restrict access to the cgi-bin directory or disable CGI scripts to minimize the risk of remote code execution.