Helping Apache Servers stay safe from zero-day path traversal attacks (CVE-2021-41773)
Oct 8, 2021Michael Tremante
Summary
This post details the CVE-2021-41773 path traversal vulnerability in Apache HTTP Server, explaining how it works by exploiting missing path normalization logic and the impact of percent-encoded characters. It highlights that Cloudflare customers with 'normalize URLs to origin' enabled are protected, and provides specific WAF rule IDs (`1c3d3022129c48e9bb52e953fe8ceb2f`, `ca955959c4ab4b1f84f681a4d0a5c982`, `100045`, `100045A`) for additional protection. It also shows a graph of exploit attempts and lists commonly targeted file paths.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack