# Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)

Incomplete fix in Apache httpd 2.4.50 still allows path traversal via encoded dot-segments, mapping URLs outside Alias directories and enabling RCE when CGI is enabled.

- Payout: $1,000
- Severity: critical
- Program: Internet Bug Bounty
- Found by (vendor credit): Ash Daulton along with the cPanel Security Team, Juan Escobar from Dreamlab Technologies, Fernando Muñoz from NULL Life CTF Team, and Shungo Kumasaka
- Found by: fms
- Disclosed: 2021-11-19
- CVE: CVE-2021-41773, CVE-2021-42013
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1400238
- Library page: https://bugbountylibrary.com/r/h1%3A1400238
- Tags: area:cloud domain:infra domain:web impact:data-leak impact:rce kind:bounty platform:hackerone sev:critical tech:linux technique:incomplete-fix vuln:path-traversal vuln:rce

**Target:** Apache HTTP Server mod_alias/mod_cgi URL-to-filesystem mapping
**Root cause:** The 2.4.50 patch for CVE-2021-41773 only blocked one encoding of dot-segments; other encoded traversal sequences still bypass the normalization, letting URLs map outside Alias-configured directories.
**Steps:**
1. Target Apache HTTP Server 2.4.49 or 2.4.50 with an Alias-like directive configured.
2. Send a request whose path uses an encoded traversal sequence (e.g. double-encoded dot-segments) that the 2.4.50 fix fails to normalize.
3. The server maps the URL to a file outside the aliased directory; if not blocked by 'require all denied', the file is served.
4. If CGI is enabled for the aliased path, request a CGI script to achieve remote code execution.
**How found:** Researchers tested the 2.4.50 patch for CVE-2021-41773 and found the fix insufficient, discovering alternate encoded traversal sequences still bypass normalization.
**Exploitation:** Attacker sends crafted traversal requests to reach files outside Alias directories; when CGI is enabled on those paths, executing a CGI script yields remote code execution.
**Escalation:** Path traversal escalates to RCE when CGI scripts are enabled for the aliased paths.
**Insight:** When a traversal patch lands, re-test alternate encodings of dot-segments (double-encoding, mixed case) against the same normalization path; incomplete fixes commonly block only the exact payload from the original report.

## Write-ups of the same bug (oldest first)
- 2021-11-09: [Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49](https://bugbountylibrary.com/r/h1%3A1394916) — monkey_logic
- 2021-11-19: [Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.50](https://bugbountylibrary.com/r/h1%3A1404731) — itsecurityco
- 2021-11-19: [Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)](https://bugbountylibrary.com/r/h1%3A1400238) — fms (this one)