Apache HTTP Server Flaw Puts Cloud Credentials at Risk; Version 2.4.51 Fixes It
Summary
Apache HTTP Server versions 2.4.49 and 2.4.50 are vulnerable to path traversal and file disclosure. Wiz warns attackers could expose cloud credentials and recommends upgrading to 2.4.51 or restricting access and permissions.
Key points
- The vulnerabilities affect Apache HTTP Server 2.4.49 and 2.4.50; the article says earlier versions are not affected.
- Path traversal could expose files outside the document root and interpreted-file source, including CGI scripts.
- Researchers published exploits, including remote command execution; the article also reports that the 2.4.50 fix could be bypassed.
- The article reports internet scanning for vulnerable servers and warns that exposed files may contain database credentials or cloud keys.
- Stolen cloud keys with excessive permissions could enable access to sensitive resources or broader cloud-environment compromise; this is described as a risk, not a confirmed incident.
- Upgrade to Apache HTTP Server 2.4.51. If patching is not possible, deactivate the resource or block its internet access.
- Limit permissions on internet-facing workloads and avoid storing sensitive, overly permissive secrets on server disks.
Article Details
- Vulnerability Types
- Path traversal
- File disclosure
- Severity
- Critical
- Affected Versions
- Apache HTTP Server 2.4.49
- Apache HTTP Server 2.4.50
- Exploitation Status
- active
- Exploit Availability
- public_exploit
- Patch Status
- available
- Workarounds
- If patching is not possible, deactivate the resource or block its internet access.
MITRE ATT&CK
T1005 · Data from Local SystemAttackers can access files outside the document root, including secrets such as cloud keys stored on the server.T1006 · Direct Volume AccessThe vulnerability enables path traversal to map URLs to files outside the expected document root.T1059 · Command and Scripting InterpreterResearchers published exploits that allow remote command execution on targeted Apache HTTP Servers.T1213 · Data from Information RepositoriesThe article describes attackers obtaining sensitive data, including database credentials and cloud keys, from vulnerable server files.
CVE
CVE-2021-41773On October 4, 2021, Apache published a patch to CVE-2021-41773/CVE-2021-42013, a path traversal and file disclosure vulnerability, affecting Apache HTTP Server version 2.4.49. Their report also shared that theCVE-2021-42013On October 4, 2021, Apache published a patch to CVE-2021-41773/CVE-2021-42013, a path traversal and file disclosure vulnerability, affecting Apache HTTP Server version 2.4.49. Their report also shared that the
Vendors
ApacheOn October 4, 2021, Apache published a patch to CVE-2021-41773/CVE-2021-42013, a path traversal and file disclosure vulnerability, affecting Apache HTTP Server version 2.4.49. Their report also shared that theWizWiz provides you with a view of full escalation paths of CVE-2021-41773/CVE-2021-42013. Malicious attackers on the internet can access vulnerable virtual machine files and obtain cloud keys with a large set of
Products
Apache HTTP Serverto CVE-2021-41773/CVE-2021-42013, a path traversal and file disclosure vulnerability, affecting Apache HTTP Server version 2.4.49. Their report also shared that the vulnerability has been exploited in the wild.Wiz Threat CenterThe Wiz Threat Center contains a pre-built query that retrieves all resources with vulnerable Apache HTTP Server versions and their corresponding escalation paths with one click.