Apache Web Server - Path Traversal (CVE-2021-42013)

CVE-2021-42013 is a critical vulnerability in the Apache HTTP Server that enables attackers to exploit insufficient fixes for prior path traversal issues, potentially accessing files outside the expected directories and executing arbitrary code if CGI scripts are enabled.

CrowdSec has been tracking this vulnerability and its exploits since 11th of October 2021.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2021-42013 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. CrowdSec data also reveals a clear uptick in attacks involving CVE-2021-42013 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Exploitation attempts typically focus on path traversal through specially crafted URLs, aiming to access unauthorized files or execute scripts on vulnerable systems.