HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunkMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog

CVE-2021-42013: Apache CGI Path Traversal / Self-Rep Payload

HoneyLabs honeypots recorded 78 probes matching CVE-2021-42013 from 56 distinct source IP addresses in the last 7 days. Severity is rated CRITICAL.

This CVE is on CISA's Known Exploited Vulnerabilities list.

Request paths that identify it

  • apache.selfrep
  • /icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/pass…
  • /icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd
  • /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh

Addresses probing it

Source IPProbesNetworkCountry
31.132.90.36Kar-Tel LLCKazakhstan
138.2.102.664Oracle CorporationSingapore
171.244.14.2163CHT Compamy LtdVietnam
185.132.43.93IONOS SEUnited Kingdom
95.173.161.1473Netinternet Bilisim Teknolojileri ASTürkiye
212.47.66.2182Contabo GmbHFrance
87.192.253.1102Uzbektelekom Joint Stock CompanyUzbekistan
103.46.186.1482PT Air Lintas KomunikasiIndonesia

Networks it comes from

ASNOrganisationProbesSource IPs
AS197556Kar-Tel LLC61
AS51167Contabo GmbH65
AS31898Oracle Corporation41
AS8560IONOS SE42
AS24940Hetzner Online GmbH32
AS51559Netinternet Bilisim Teknolojileri AS31

Captured requests

  • /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh

HTTP client fingerprints (JA4H)

  • po11nn0700_765287bee650
  • po11nn0700_c5a94e7539c9
  • po11nn0700_5a5182d16ecb
  • po11nn0700_fd0bf528810b

CVE report

CVE report

Open a specific CVE from the CVE tracker.