CVE-2021-41773: Apache 2.4.49 - Path Traversal and Remote Code Execution
HoneyLabs honeypots recorded 63 probes matching CVE-2021-41773 from 40 distinct source IP addresses in the last 7 days. Severity is rated high.
This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2021-11-03.
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-01, with 12. No single address sent more than 10% of them. The largest source network was AS36352 (HostPapa), with 13% of the probes from 3 addresses. It is still being probed 5 years after CISA added it to the Known Exploited Vulnerabilities list. Over the last 90 days the sensors recorded 1,567 probes for it. The probing clients presented 3 distinct TLS fingerprints, most often t13i191000_9dc949149365_e5728521abd4.
Request paths that identify it
- /cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd
- /icons/.%2e/%2e%2e
- /icons/.%2e/.%2e
- /cgi-bin/.%2e
- /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh
- /icons/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 104.168.101.23 | 6 | HostPapa | United States |
| 165.99.207.153 | 4 | PERN AS Content Servie Provider, Islamabad, Pakistan | Pakistan |
| 212.47.78.233 | 4 | Contabo GmbH | France |
| 103.46.186.148 | 3 | PT Air Lintas Komunikasi | Indonesia |
| 66.92.21.200 | 3 | Psychz Networks | United States |
| 102.244.97.185 | 2 | Orange Cameroun SA | Cameroon |
| 103.160.205.37 | 2 | PT Akbar Prima Media | Indonesia |
| 120.48.21.92 | 2 | Beijing Baidu Netcom Science and Technology Co., Ltd. | China |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS36352 | HostPapa | 8 | 3 |
| AS51167 | Contabo GmbH | 6 | 3 |
| AS135377 | UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED | 5 | 4 |
| AS45773 | PERN AS Content Servie Provider, Islamabad, Pakistan | 4 | 1 |
| AS12876 | Scaleway SAS | 3 | 2 |
| AS150462 | PT Air Lintas Komunikasi | 3 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| United States | 20 |
| France | 9 |
| China | 8 |
| Indonesia | 5 |
| Pakistan | 4 |
| Brazil | 3 |
Captured requests
- /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh
- /icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ
- /cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwd
- /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/hosts
HTTP client fingerprints
- b11cun062_00040016_84d4cebf_xce00d0f1
- b11cun040_00040013_608dab68
- b11cuq070_00050835_c0b30902
- b11cun030_00040012_13ee3d34
CVE report
Open a specific CVE from the CVE tracker.