Apache Web Server - Path Traversal (CVE-2021-42013)

CVE-2021-42013 is a critical vulnerability in the Apache HTTP Server that enables attackers to exploit insufficient fixes for prior path traversal issues, potentially accessing files outside the expected directories and executing arbitrary code if CGI scripts are enabled.

CrowdSec has been tracking this vulnerability and its exploits since 11th of October 2021.

CrowdSec network data shows that most actors exploiting CVE-2021-42013 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2021-42013 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2021-42013 is currently experiencing high visibility and active exploitation across the internet.

Exploitation attempts typically focus on path traversal through specially crafted URLs, aiming to access unauthorized files or execute scripts on vulnerable systems.