Apache HTTP Server 2.4.49 / 2.4.50 path traversal CVE-2021-41773 and CVE-2021-42013 (file disclosure and RCE with CGI, CISA KEV): how do I check old servers and containers and fix them?

What it is: In October 2021, a change in Apache httpd 2.4.49's path normalization let crafted URLs escape the document root (CVE-2021-41773). The 2.4.50 fix was incomplete (CVE-2021-42013). On servers where the filesystem isn't protected by the default 'Require all denied' rule, attackers can read files outside the web root, and when mod_cgi/CGI scripts are enabled they can run commands. Both were exploited within days and are in CISA's KEV catalog. They keep showing up in old Docker images, appliances and forgotten servers pinned to httpd:2.4.49 or 2.4.50. Am I affected: - Only Apache HTTP Server 2.4.49 and 2.4.50 exactly. Earlier and later versions are not affected by these two CVEs. - Check with httpd -v or apachectl -v (apache2 -v on Debian/Ubuntu), and the tag of any httpd container image (docker image ls, or your Dockerfile FROM line). - Highest risk: the default '<Directory /> Require all denied' block was removed or loosened, and/or CGI is enabled (mod_cgi, mod_cgid, ScriptAlias). Fix: 1. Upgrade to the latest Apache httpd 2.4 release (2.4.51 was the first full fix; current releases also fix many later CVEs). For containers, rebuild from a current httpd:2.4 image and redeploy. 2. Keep the default deny for the filesystem root in httpd.conf: <Directory /> AllowOverride None, Require all denied </Directory>, and only allow the directories you serve. 3. Disable CGI modules if you don't use them. 4. If an affected server was internet-facing, check access logs for encoded traversal requests (sequences like '.%2e/' or '%%32%65') to /cgi-bin/ or /icons/, look for unknown processes, files and cron jobs, and rotate secrets readable by the web server user (config files, .env, keys). Verify: httpd -v shows a current 2.4 release, and the running configuration still contains the root 'Require all denied' rule (apachectl -S and a review of httpd.conf). Sources: https://httpd.apache.org/security/vulnerabilities_24.html https://nvd.nist.gov/vuln/detail/CVE-2021-41773 https://nvd.nist.gov/vuln/detail/CVE-2021-42013 https://www.cisa.gov/known-exploited-vulnerabilities-catalog