HomePentest-Tools.com Logo

Apache Server - Arbitrary File Read CVE-2021-42013

Severity
CVSSv3 Score
9.8
Vulnerability description

Apache server is affected by an Arbitrary File Read through a Path Traversal vulnerability, located on the /cgi-bin endpoint. Any file outside the document root that is not protected with the "require all denied" configuration can be accessed by an unauthenticated remote attacker. The root cause of this vulnerability consists in a change done to the path normalization code in 2.4.49-2.4.50 versions of the Apache server. Only this specific versions are affected.

Risk description

The risk exists that a remote unauthenticated attacker could exploit this vulnerability to read sensitive information from arbitrary files located on the file system of the server.

Exploit capabilities

Sniper can read arbitrary files from the target system and extract them as evidence.

Recommendation

Upgrade the Apache server to a version equal or higher than 2.4.51.

Codename
Not available
Detectable with
Network Scanner
Scan engine
Sniper
Exploitable with Sniper
Yes
CVE Published
Oct 1, 2021
Detection added at
Software Type
Web server
Vendor
Apache
Product
Server