HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunkMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog

CVE-2021-42013: Apache CGI Path Traversal / Self-Rep Payload

HoneyLabs honeypots recorded 91 probes matching CVE-2021-42013 from 71 distinct source IP addresses in the last 7 days. Severity is rated CRITICAL.

This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2021-11-03.

Request paths that identify it

  • apache.selfrep
  • /icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/pass…
  • /icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd
  • /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh

Addresses probing it

Source IPProbesNetworkCountry
103.46.186.1483PT Air Lintas KomunikasiIndonesia
152.32.225.1173UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDHong Kong
177.10.160.463Chapeco Tecnologia em Telecomunicacoes Ltda.Brazil
184.185.26.513Cox Communications Inc.United States
107.155.48.462UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDUnited States
144.225.6.1842CNServer LLCUnited States
152.32.236.1022UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDUnited States
160.250.132.2382EZ TECHNOLOGY COMPANY LIMITEDVietnam

Networks it comes from

ASNOrganisationProbesSource IPs
AS135377UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED106
AS51167Contabo GmbH87
AS37963Hangzhou Alibaba Advertising Co.,Ltd.54
AS45090Shenzhen Tencent Computer Systems Company Limited55
AS14061DigitalOcean, LLC44
AS150462PT Air Lintas Komunikasi31

Where it comes from

CountryProbes
United States24
China15
France9
Germany6
Brazil4
Hong Kong4

Captured requests

  • /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh

HTTP client fingerprints

  • b11cuq070_00050835_c0b30902

CVE report

CVE report

Open a specific CVE from the CVE tracker.