{"cve_id":"CVE-2021-42013","title":"Apache CGI Path Traversal / Self-Rep Payload","severity":"CRITICAL","actively_exploited":true,"patterns":["apache.selfrep","/icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd","/icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd","/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh"],"events":1788,"unique_ips":765,"actors":[{"ip":"83.168.106.26","events":42,"country_code":"PL","country":"Poland","org":"SkyPass Solutions Sp. z.o.o.","rdns":"hosted-by.skillhost.pl","scanner_tag":null},{"ip":"110.35.80.116","events":37,"country_code":"ID","country":"Indonesia","org":"PT. NAP Info Lintas Nusa","rdns":"IP-80-116.napinfo.net","scanner_tag":null},{"ip":"101.47.8.187","events":35,"country_code":"SG","country":"Singapore","org":"Byteplus Pte. Ltd.","rdns":"","scanner_tag":null},{"ip":"31.132.90.3","events":33,"country_code":"KZ","country":"Kazakhstan","org":"Kar-Tel LLC","rdns":"","scanner_tag":null},{"ip":"101.36.104.242","events":29,"country_code":"JP","country":"Japan","org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","rdns":"","scanner_tag":null},{"ip":"185.38.148.2","events":28,"country_code":"GB","country":"United Kingdom","org":"Hydra Communications Ltd","rdns":"2.148.38.185.baremetal.zare.com","scanner_tag":null},{"ip":"47.253.5.130","events":25,"country_code":"US","country":"United States","org":"Alibaba US Technology Co., Ltd.","rdns":"","scanner_tag":null},{"ip":"172.185.40.47","events":14,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"","scanner_tag":null},{"ip":"118.145.104.105","events":13,"country_code":"CN","country":"China","org":"Beijing Volcano Engine Technology Co., Ltd.","rdns":"","scanner_tag":null},{"ip":"202.183.141.133","events":13,"country_code":"TH","country":"Thailand","org":"SBN-ISPAWN-ISP and SBN-NIXAWN-NIX","rdns":"","scanner_tag":null},{"ip":"89.126.211.166","events":13,"country_code":"UZ","country":"Uzbekistan","org":"Uzbektelekom Joint Stock Company","rdns":"","scanner_tag":null},{"ip":"117.175.140.121","events":12,"country_code":"CN","country":"China","org":"China Mobile Communications Group Co., Ltd.","rdns":"","scanner_tag":null},{"ip":"81.226.129.67","events":12,"country_code":"SE","country":"Sweden","org":"Telia Company AB","rdns":"81-226-129-67-no2662.tbcn.telia.com","scanner_tag":null},{"ip":"180.76.172.156","events":12,"country_code":"CN","country":"China","org":"Beijing Baidu Netcom Science and Technology Co., Ltd.","rdns":"","scanner_tag":null},{"ip":"5.175.169.63","events":11,"country_code":"DE","country":"Germany","org":"TeraSwitch Networks Inc.","rdns":"placeholder.noez.de","scanner_tag":null},{"ip":"47.95.234.23","events":11,"country_code":"CN","country":"China","org":"Hangzhou Alibaba Advertising Co.,Ltd.","rdns":"","scanner_tag":null},{"ip":"41.75.114.30","events":11,"country_code":"MW","country":"Malawi","org":"SKYBAND","rdns":"","scanner_tag":null},{"ip":"216.57.110.81","events":11,"country_code":"HK","country":"Hong Kong","org":"","rdns":"","scanner_tag":null},{"ip":"79.76.58.113","events":10,"country_code":"SE","country":"Sweden","org":"Oracle Corporation","rdns":"","scanner_tag":null},{"ip":"189.51.43.54","events":10,"country_code":"BR","country":"Brazil","org":"INOVE TELECOMUNICACOES E SERVICOS LTDA","rdns":"","scanner_tag":null},{"ip":"212.127.91.32","events":10,"country_code":"PL","country":"Poland","org":"Korbank S. A.","rdns":"","scanner_tag":null},{"ip":"125.20.210.182","events":10,"country_code":"IN","country":"India","org":"BHARTI Airtel Ltd.","rdns":"","scanner_tag":null},{"ip":"47.85.8.171","events":10,"country_code":"US","country":"United States","org":"Alibaba US Technology Co., Ltd.","rdns":"","scanner_tag":null},{"ip":"83.229.8.197","events":9,"country_code":"IT","country":"Italy","org":"Convergenze S.p.A.","rdns":"host197-8-229-83.convergenze.it","scanner_tag":null},{"ip":"120.48.32.130","events":9,"country_code":"CN","country":"China","org":"Beijing Baidu Netcom Science and Technology Co., Ltd.","rdns":"","scanner_tag":null},{"ip":"118.26.111.107","events":9,"country_code":"SG","country":"Singapore","org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","rdns":"","scanner_tag":null},{"ip":"152.32.226.205","events":9,"country_code":"HK","country":"Hong Kong","org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","rdns":"9585298.xyz","scanner_tag":null},{"ip":"120.236.49.131","events":9,"country_code":"CN","country":"China","org":"China Mobile Communications Group Co., Ltd.","rdns":"","scanner_tag":null},{"ip":"46.191.157.159","events":9,"country_code":"RU","country":"Russia","org":"JSC Ufanet","rdns":"46.191.157.159.dynamic.ufanet.ru","scanner_tag":null},{"ip":"101.47.15.119","events":9,"country_code":"SG","country":"Singapore","org":"Byteplus Pte. Ltd.","rdns":"","scanner_tag":null},{"ip":"199.21.150.105","events":8,"country_code":"CA","country":"Canada","org":"Netminders Server Hosting","rdns":"difgo4.com","scanner_tag":null},{"ip":"120.241.79.66","events":8,"country_code":"CN","country":"China","org":"China Mobile communications corporation","rdns":"","scanner_tag":null},{"ip":"163.7.1.156","events":8,"country_code":"ID","country":"Indonesia","org":"Byteplus Pte. Ltd.","rdns":"","scanner_tag":null},{"ip":"115.248.8.65","events":8,"country_code":"IN","country":"India","org":"Reliance Communications Ltd.DAKC MUMBAI","rdns":"","scanner_tag":null},{"ip":"198.11.178.150","events":8,"country_code":"US","country":"United States","org":"Alibaba US Technology Co., Ltd.","rdns":"","scanner_tag":null},{"ip":"115.191.32.57","events":8,"country_code":"CN","country":"China","org":"Beijing Volcano Engine Technology Co., Ltd.","rdns":"","scanner_tag":null},{"ip":"151.185.42.72","events":7,"country_code":"IN","country":"India","org":"282, Sector 19","rdns":"e2e-131-72.ssdcloudindia.net","scanner_tag":null},{"ip":"85.239.239.57","events":7,"country_code":"US","country":"United States","org":"Contabo Inc.","rdns":"vmi3340136.contaboserver.net","scanner_tag":{"key":"contabo","label":"Contabo","category":"hosting_provider","url":"https://contabo.com/"}},{"ip":"178.17.53.215","events":7,"country_code":"FI","country":"Finland","org":"Global Connectivity Solutions Llp","rdns":"","scanner_tag":null},{"ip":"35.194.141.75","events":7,"country_code":"TW","country":"Taiwan","org":"Google LLC","rdns":"75.141.194.35.bc.googleusercontent.com","scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"}},{"ip":"212.127.90.201","events":7,"country_code":"PL","country":"Poland","org":"Korbank S. A.","rdns":"margarete.static.ip.WRO.Korbank.PL","scanner_tag":null},{"ip":"209.99.185.239","events":7,"country_code":"US","country":"United States","org":"","rdns":"","scanner_tag":null},{"ip":"147.135.3.156","events":7,"country_code":"US","country":"United States","org":"OVH SAS","rdns":"rane-r.vps.co.ve","scanner_tag":null},{"ip":"90.84.168.147","events":7,"country_code":"FR","country":"France","org":"Orange","rdns":"ecs-90-84-168-147.reverse.open-telekom-cloud.com","scanner_tag":null},{"ip":"223.85.251.55","events":7,"country_code":"CN","country":"China","org":"China Mobile Communications Group Co., Ltd.","rdns":"","scanner_tag":null},{"ip":"118.196.56.74","events":7,"country_code":"CN","country":"China","org":"China Telecom Group","rdns":"","scanner_tag":null},{"ip":"118.145.245.82","events":7,"country_code":"CN","country":"China","org":"Beijing Volcano Engine Technology Co., Ltd.","rdns":"","scanner_tag":null},{"ip":"103.96.147.148","events":6,"country_code":"ID","country":"Indonesia","org":"PT Era Awan Digital","rdns":"relay3.smtp.id","scanner_tag":null},{"ip":"5.175.169.118","events":6,"country_code":"DE","country":"Germany","org":"TeraSwitch Networks Inc.","rdns":"placeholder.noez.de","scanner_tag":null},{"ip":"103.147.237.208","events":6,"country_code":"ID","country":"Indonesia","org":"PT. Medialink Intercontinental","rdns":"","scanner_tag":null}],"top_asns":[{"asn":45102,"org":"Alibaba US Technology Co., Ltd.","events":118,"ips":49},{"asn":51167,"org":"Contabo GmbH","events":89,"ips":55},{"asn":135377,"org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","events":84,"ips":14},{"asn":9808,"org":"China Mobile Communications Group Co., Ltd.","events":75,"ips":26},{"asn":150436,"org":"Byteplus Pte. Ltd.","events":59,"ips":5},{"asn":137718,"org":"Beijing Volcano Engine Technology Co., Ltd.","events":53,"ips":15},{"asn":14061,"org":"DigitalOcean, LLC","events":43,"ips":28},{"asn":202520,"org":"SkyPass Solutions Sp. z.o.o.","events":43,"ips":2},{"asn":17727,"org":"PT. NAP Info Lintas Nusa","events":37,"ips":1},{"asn":37963,"org":"Hangzhou Alibaba Advertising Co.,Ltd.","events":37,"ips":21}],"fingerprints":{"ja4h":["po11nn0700_c5a94e7539c9","po11nn0700_cfe31aff51dc","po11nn0700_5a5182d16ecb","po11nn0700_a1f20e5bfd9b","po11nn0700_74abfbbd1cb4","po11nn0700_04eba2b94511"],"ja4":["t13i250900_b78ed14e2fd0_e7c285222651","t13i170900_5b57614c22b0_78e6aca7449b"]},"sample_paths":["/icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd","/icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd","/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh"],"timeline":[{"day":"2026-04-29","events":1,"ips":1},{"day":"2026-04-30","events":13,"ips":13},{"day":"2026-05-01","events":9,"ips":9},{"day":"2026-05-02","events":8,"ips":8},{"day":"2026-05-03","events":17,"ips":17},{"day":"2026-05-04","events":17,"ips":17},{"day":"2026-05-05","events":19,"ips":17},{"day":"2026-05-06","events":42,"ips":35},{"day":"2026-05-07","events":12,"ips":9},{"day":"2026-05-08","events":29,"ips":26},{"day":"2026-05-09","events":22,"ips":22},{"day":"2026-05-10","events":29,"ips":27},{"day":"2026-05-11","events":18,"ips":18},{"day":"2026-05-12","events":29,"ips":22},{"day":"2026-05-13","events":22,"ips":20},{"day":"2026-05-14","events":24,"ips":20},{"day":"2026-05-15","events":24,"ips":21},{"day":"2026-05-16","events":30,"ips":22},{"day":"2026-05-17","events":15,"ips":15},{"day":"2026-05-18","events":15,"ips":14},{"day":"2026-05-19","events":24,"ips":23},{"day":"2026-05-20","events":9,"ips":9},{"day":"2026-05-21","events":29,"ips":27},{"day":"2026-05-22","events":15,"ips":12},{"day":"2026-05-23","events":19,"ips":17},{"day":"2026-05-24","events":15,"ips":14},{"day":"2026-05-25","events":19,"ips":17},{"day":"2026-05-26","events":12,"ips":11},{"day":"2026-05-27","events":16,"ips":16},{"day":"2026-05-28","events":23,"ips":20},{"day":"2026-05-29","events":22,"ips":20},{"day":"2026-05-30","events":31,"ips":26},{"day":"2026-05-31","events":19,"ips":18},{"day":"2026-06-01","events":34,"ips":31},{"day":"2026-06-02","events":38,"ips":34},{"day":"2026-06-03","events":26,"ips":23},{"day":"2026-06-04","events":25,"ips":22},{"day":"2026-06-05","events":25,"ips":23},{"day":"2026-06-06","events":25,"ips":21},{"day":"2026-06-07","events":17,"ips":17},{"day":"2026-06-08","events":13,"ips":13},{"day":"2026-06-09","events":12,"ips":10},{"day":"2026-06-10","events":19,"ips":17},{"day":"2026-06-11","events":18,"ips":18},{"day":"2026-06-12","events":27,"ips":25},{"day":"2026-06-13","events":28,"ips":27},{"day":"2026-06-14","events":20,"ips":19},{"day":"2026-06-15","events":31,"ips":29},{"day":"2026-06-16","events":21,"ips":18},{"day":"2026-06-17","events":22,"ips":21},{"day":"2026-06-18","events":21,"ips":21},{"day":"2026-06-19","events":19,"ips":16},{"day":"2026-06-20","events":29,"ips":27},{"day":"2026-06-21","events":21,"ips":18},{"day":"2026-06-22","events":17,"ips":16},{"day":"2026-06-23","events":20,"ips":19},{"day":"2026-06-24","events":14,"ips":14},{"day":"2026-06-25","events":18,"ips":18},{"day":"2026-06-26","events":15,"ips":13},{"day":"2026-06-27","events":16,"ips":16},{"day":"2026-06-28","events":23,"ips":21},{"day":"2026-06-29","events":16,"ips":16},{"day":"2026-06-30","events":15,"ips":15},{"day":"2026-07-01","events":22,"ips":20},{"day":"2026-07-02","events":17,"ips":15},{"day":"2026-07-03","events":18,"ips":16},{"day":"2026-07-04","events":17,"ips":17},{"day":"2026-07-05","events":12,"ips":12},{"day":"2026-07-06","events":18,"ips":16},{"day":"2026-07-07","events":16,"ips":15},{"day":"2026-07-08","events":11,"ips":11},{"day":"2026-07-09","events":17,"ips":14},{"day":"2026-07-10","events":33,"ips":28},{"day":"2026-07-11","events":16,"ips":16},{"day":"2026-07-12","events":20,"ips":18},{"day":"2026-07-13","events":23,"ips":22},{"day":"2026-07-14","events":20,"ips":17},{"day":"2026-07-15","events":20,"ips":19},{"day":"2026-07-16","events":20,"ips":20},{"day":"2026-07-17","events":28,"ips":25},{"day":"2026-07-18","events":25,"ips":23},{"day":"2026-07-19","events":14,"ips":14},{"day":"2026-07-20","events":22,"ips":19},{"day":"2026-07-21","events":14,"ips":14},{"day":"2026-07-22","events":16,"ips":14},{"day":"2026-07-23","events":15,"ips":14},{"day":"2026-07-24","events":14,"ips":12},{"day":"2026-07-25","events":7,"ips":5},{"day":"2026-07-26","events":10,"ips":8},{"day":"2026-07-27","events":17,"ips":17},{"day":"2026-07-28","events":13,"ips":10}],"window_hours":2160}