HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsAEI IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / Enrich
DocsBlog

CVE report

CVE-2021-42013CRITICALKEV

Apache CGI Path Traversal / Self-Rep Payload

Events 90d

1,786

Distinct IPs

768

Severity

CRITICAL

CISA KEV

Actively exploited

Detection signature

An event counts toward CVE-2021-42013 when its URL path contains any of these (case-insensitive). This is what our matching is based on.

  • · apache.selfrep
  • · /icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd
  • · /icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd
  • · /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh

Pre-disclosure activity

all early actors →

Analysing probe history around the publication date…

Recent probe volume (last 7 days)

peak: 42 events/day
04-2805-1105-2406-0606-1907-0207-1507-27
eventsdistinct IPs

Downloads & integrations

CSV (source IPs)JSONSave as feed

Top sources probing for CVE-2021-42013

Top networks the attempts come from

Fingerprints of the clients exploiting this

The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.

ja4h: po11nn0700_c5a94e7539c9ja4h: po11nn0700_cfe31aff51dcja4h: po11nn0700_5a5182d16ecbja4h: po11nn0700_a1f20e5bfd9bja4h: po11nn0700_74abfbbd1cb4ja4h: po11nn0700_04eba2b94511ja4: t13i250900_b78ed14e2fd0_e7c285222651ja4: t13i170900_5b57614c22b0_78e6aca7449b

Sample request paths observed

  • /icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd
  • /icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd
  • /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh