# Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

Path normalization flaw in Apache httpd 2.4.49 lets attackers traverse outside Alias directories to read files, or reach RCE via CGI.

- Payout: $4,000
- Severity: critical
- Program: Internet Bug Bounty
- Found by (vendor credit): Ash Daulton along with the cPanel Security Team
- Found by: monkey_logic
- Disclosed: 2021-11-09
- CVE: CVE-2021-41773
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1394916
- Library page: https://bugbountylibrary.com/r/h1%3A1394916
- Tags: area:web domain:web impact:data-leak impact:rce kind:bounty platform:hackerone sev:critical tech:linux technique:source-review vuln:info-disclosure vuln:path-traversal vuln:rce

**Target:** Apache HTTP Server 2.4.49 path normalization / Alias directives
**Root cause:** A change to path normalization in 2.4.49 failed to properly collapse traversal sequences, so URLs could map outside directories configured by Alias-like directives.
**Steps:**
1. Target an Apache 2.4.49 server with Alias-like directives configured.
2. Send a crafted URL containing path traversal sequences so normalization maps it outside the aliased directory.
3. If files outside are not protected by default 'require all denied', the request succeeds and file contents are returned.
4. If CGI scripts are enabled for aliased paths, traversal to a CGI binary can yield remote code execution.
**Exploitation:** Attacker requests crafted traversal URLs against an aliased path; when the target directory lacks 'require all denied', httpd serves files outside the alias, disclosing sensitive data. With CGI enabled on aliased paths, traversal reaches CGI binaries enabling RCE. Known exploited in the wild.
**Escalation:** File disclosure escalates to RCE when CGI scripts are enabled for aliased paths; disclosed password files enable brute-force account compromise.
**Insight:** Path normalization rewrites are high-risk: after any change to URL canonicalization, test traversal sequences against Alias/Directory directives, and check whether CGI handlers on aliased paths turn disclosure into RCE.

## Write-ups of the same bug (oldest first)
- 2021-11-09: [Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49](https://bugbountylibrary.com/r/h1%3A1394916) — monkey_logic (this one)
- 2021-11-19: [Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)](https://bugbountylibrary.com/r/h1%3A1400238) — fms