{"uuid": "9eb96080-3d0d-48a7-b9a9-b01e661d071d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/hacking_Attack/26417", "content": "Black Hat Ethical Hacking\nApache fixes actively exploited zero-day vulnerability, patch now\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Apache fixes actively exploited zero-day vulnerability, patch nowPost Views: 160 \nReading Time: 1 Minute\nThe Apache Software Foundation has released version 2.4.50 of the HTTP Web Server to address two vulnerabilities, one of which is an actively exploited path traversal and file disclosure flaw.\nThe Apache HTTP Server is an open-source, cross-platform web server that is extremely popular for being versatile, robust, and free. As such, any vulnerability in the product has widespread consequences.\n\nThe actively exploited zero-day vulnerability is tracked as CVE-2021-41773\u00a0and it enables actors to map URLs to files outside the expected document root by launching a path traversal attack.\n\nPath traversal attacks involve sending requests to access backend or sensitive server directories that should be out of reach. Normally, these requests are blocked, but in this case, the filters are bypassed by using encoded characters (ASCII) for the URLs.\n\nAdditionally, exploits of this flaw may lead to the leaking of the source of interpreted files such as CGI scripts.\nSee Also: Complete Offensive Security and Ethical Hacking Course For the attack to work, the target has to run Apache HTTP Server 2.4.49, and also has to have the \u201crequire all denied\u201d access control parameter disabled. Unfortunately, this appears to be the default configuration.\n\nEarlier Apache Server versions or those having a different access configuration aren\u2019t vulnerable to this flaw.\n\nSince the disclosure of the vulnerability, security researchers have been able to reproduce the vulnerability and warned that admins should patch immediately.\n\ud83d\udd25 We have reproduced the fresh CVE-2021-41773 Path Traversal vulnerability in Apache 2.4.49.\n\nIf files outside of the document root are not protected by \"require all denied\" these requests can succeed.\n\nPatch ASAP! https://t.co/6JrbayDbqG pic.twitter.com/AnsaJszPTE\n\n\u2014 PT SWARM (@ptswarm) October 5, 2021\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones A Shodan search revealed that there are over a hundred thousand Apache HTTP Server 2.4.49 deployments online, many of which could be vulnerable to exploitation, so updating your software as soon as possible should be considered\u00a0exigent.\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/apache_number.jpg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:46.589310Z"}