Threat Advisory: Apache HTTP Server zero-day vulnerability opens door for attackers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-41733 | Oppia 3.1.4 does not verify that certain URLs are valid before navigating to them | 6.1 | <1% | ||
| CVE-2021-42013 | Path Traversal and RCE in Apache HTTP Server (follow-up to CVE-2021-41773) | 9.8 | 100% | KEVRansomwarePoC ×6 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 134.122.112.12 | this threat. Indicators of compromise (IoCs) IP Addresses: 134.122.112.12 143.198.136.88 161.35.188.242 161.35.86.181 167.99.133.28 1 |
| ipv4 | 137.184.69.137 | 55 161.35.215.189 143.198.62.76 174.138.42.66 46.101.59.235 137.184.69.137 165.227.125.18 |
| ipv4 | 141.101.146.162 | 46.210.169 94.46.15.22 69.49.228.92 69.49.235.93 3.83.56.46 141.101.146.162 156.146.50.105 156.146.50.98 185.254.96.162 185.56.80.11 19 |
| ipv4 | 14.161.74.29 | 40.67 47.106.92.240 45.77.138.50 45.86.203.97 27.102.114.78 14.161.74.29 149.28.140.81 185.98.87.200 217.138.216.4 142.93.153.4 178. |
| ipv4 | 142.93.153.4 | 4.78 14.161.74.29 149.28.140.81 185.98.87.200 217.138.216.4 142.93.153.4 178.128.172.249 79.165.90.196 51.79.142.118 59.12.193.82 64 |
| ipv4 | 143.198.136.88 | ndicators of compromise (IoCs) IP Addresses: 134.122.112.12 143.198.136.88 161.35.188.242 161.35.86.181 167.99.133.28 162.241.114.189 |
| ipv4 | 143.198.62.76 | 45.146.164.110 145.220.25.28 165.227.79.155 161.35.215.189 143.198.62.76 174.138.42.66 46.101.59.235 137.184.69.137 165.227.125.18 |
| ipv4 | 145.220.25.28 | 22 35.82.51.168 37.237.230.28 44.242.181.147 45.146.164.110 145.220.25.28 165.227.79.155 161.35.215.189 143.198.62.76 174.138.42.66 4 |
| ipv4 | 149.28.140.81 | 92.240 45.77.138.50 45.86.203.97 27.102.114.78 14.161.74.29 149.28.140.81 185.98.87.200 217.138.216.4 142.93.153.4 178.128.172.249 79 |
| ipv4 | 156.146.50.105 | .15.22 69.49.228.92 69.49.235.93 3.83.56.46 141.101.146.162 156.146.50.105 156.146.50.98 185.254.96.162 185.56.80.11 194.126.177.17 19 |
| ipv4 | 156.146.50.98 | 8.92 69.49.235.93 3.83.56.46 141.101.146.162 156.146.50.105 156.146.50.98 185.254.96.162 185.56.80.11 194.126.177.17 192.3.194.202 89 |
| ipv4 | 161.35.188.242 | mpromise (IoCs) IP Addresses: 134.122.112.12 143.198.136.88 161.35.188.242 161.35.86.181 167.99.133.28 162.241.114.189 162.241.69.182 |
| ipv4 | 161.35.215.189 | 44.242.181.147 45.146.164.110 145.220.25.28 165.227.79.155 161.35.215.189 143.198.62.76 174.138.42.66 46.101.59.235 137.184.69.137 16 |
| ipv4 | 161.35.86.181 | IP Addresses: 134.122.112.12 143.198.136.88 161.35.188.242 161.35.86.181 167.99.133.28 162.241.114.189 162.241.69.182 185.246.210.16 |
| ipv4 | 162.241.114.189 | 2 143.198.136.88 161.35.188.242 161.35.86.181 167.99.133.28 162.241.114.189 162.241.69.182 185.246.210.169 94.46.15.22 69.49.228.92 69. |
| ipv4 | 162.241.69.182 | 161.35.188.242 161.35.86.181 167.99.133.28 162.241.114.189 162.241.69.182 185.246.210.169 94.46.15.22 69.49.228.92 69.49.235.93 3.83. |
| ipv4 | 165.227.125.18 | 89 143.198.62.76 174.138.42.66 46.101.59.235 137.184.69.137 165.227.125.18 |
| ipv4 | 165.227.79.155 | 8 37.237.230.28 44.242.181.147 45.146.164.110 145.220.25.28 165.227.79.155 161.35.215.189 143.198.62.76 174.138.42.66 46.101.59.235 13 |
| ipv4 | 167.99.133.28 | 134.122.112.12 143.198.136.88 161.35.188.242 161.35.86.181 167.99.133.28 162.241.114.189 162.241.69.182 185.246.210.169 94.46.15.22 |
| ipv4 | 174.138.42.66 | 0 145.220.25.28 165.227.79.155 161.35.215.189 143.198.62.76 174.138.42.66 46.101.59.235 137.184.69.137 165.227.125.18 |
| ipv4 | 178.128.172.249 | 4.29 149.28.140.81 185.98.87.200 217.138.216.4 142.93.153.4 178.128.172.249 79.165.90.196 51.79.142.118 59.12.193.82 64.39.106.120 64.3 |
| ipv4 | 185.246.210.169 | 161.35.86.181 167.99.133.28 162.241.114.189 162.241.69.182 185.246.210.169 94.46.15.22 69.49.228.92 69.49.235.93 3.83.56.46 141.101.14 |
| ipv4 | 185.254.96.162 | .93 3.83.56.46 141.101.146.162 156.146.50.105 156.146.50.98 185.254.96.162 185.56.80.11 194.126.177.17 192.3.194.202 89.248.173.143 80 |
| ipv4 | 185.56.80.11 | 141.101.146.162 156.146.50.105 156.146.50.98 185.254.96.162 185.56.80.11 194.126.177.17 192.3.194.202 89.248.173.143 80.239.140.67 4 |
| ipv4 | 185.98.87.200 | 38.50 45.86.203.97 27.102.114.78 14.161.74.29 149.28.140.81 185.98.87.200 217.138.216.4 142.93.153.4 178.128.172.249 79.165.90.196 51 |
| ipv4 | 192.3.194.202 | 05 156.146.50.98 185.254.96.162 185.56.80.11 194.126.177.17 192.3.194.202 89.248.173.143 80.239.140.67 47.106.92.240 45.77.138.50 45. |
| ipv4 | 194.126.177.17 | 62 156.146.50.105 156.146.50.98 185.254.96.162 185.56.80.11 194.126.177.17 192.3.194.202 89.248.173.143 80.239.140.67 47.106.92.240 45 |
| ipv4 | 217.138.216.4 | 3.97 27.102.114.78 14.161.74.29 149.28.140.81 185.98.87.200 217.138.216.4 142.93.153.4 178.128.172.249 79.165.90.196 51.79.142.118 59 |
| ipv4 | 27.102.114.78 | 3.143 80.239.140.67 47.106.92.240 45.77.138.50 45.86.203.97 27.102.114.78 14.161.74.29 149.28.140.81 185.98.87.200 217.138.216.4 142. |
| ipv4 | 34.223.64.22 | 2.118 59.12.193.82 64.39.106.120 64.39.98.36 45.155.204.183 34.223.64.22 35.82.51.168 37.237.230.28 44.242.181.147 45.146.164.110 14 |
| ipv4 | 35.82.51.168 | 93.82 64.39.106.120 64.39.98.36 45.155.204.183 34.223.64.22 35.82.51.168 37.237.230.28 44.242.181.147 45.146.164.110 145.220.25.28 1 |
| ipv4 | 37.237.230.28 | 06.120 64.39.98.36 45.155.204.183 34.223.64.22 35.82.51.168 37.237.230.28 44.242.181.147 45.146.164.110 145.220.25.28 165.227.79.155 |
| ipv4 | 3.83.56.46 | 9.182 185.246.210.169 94.46.15.22 69.49.228.92 69.49.235.93 3.83.56.46 141.101.146.162 156.146.50.105 156.146.50.98 185.254.96.162 |
| ipv4 | 44.242.181.147 | 8.36 45.155.204.183 34.223.64.22 35.82.51.168 37.237.230.28 44.242.181.147 45.146.164.110 145.220.25.28 165.227.79.155 161.35.215.189 |
| ipv4 | 45.146.164.110 | .183 34.223.64.22 35.82.51.168 37.237.230.28 44.242.181.147 45.146.164.110 145.220.25.28 165.227.79.155 161.35.215.189 143.198.62.76 1 |
| ipv4 | 45.155.204.183 | 90.196 51.79.142.118 59.12.193.82 64.39.106.120 64.39.98.36 45.155.204.183 34.223.64.22 35.82.51.168 37.237.230.28 44.242.181.147 45.1 |
| ipv4 | 45.77.138.50 | 17 192.3.194.202 89.248.173.143 80.239.140.67 47.106.92.240 45.77.138.50 45.86.203.97 27.102.114.78 14.161.74.29 149.28.140.81 185.9 |
| ipv4 | 45.86.203.97 | 202 89.248.173.143 80.239.140.67 47.106.92.240 45.77.138.50 45.86.203.97 27.102.114.78 14.161.74.29 149.28.140.81 185.98.87.200 217. |
| ipv4 | 46.101.59.235 | 8 165.227.79.155 161.35.215.189 143.198.62.76 174.138.42.66 46.101.59.235 137.184.69.137 165.227.125.18 |
| ipv4 | 47.106.92.240 | 1 194.126.177.17 192.3.194.202 89.248.173.143 80.239.140.67 47.106.92.240 45.77.138.50 45.86.203.97 27.102.114.78 14.161.74.29 149.28 |
| ipv4 | 51.79.142.118 | 00 217.138.216.4 142.93.153.4 178.128.172.249 79.165.90.196 51.79.142.118 59.12.193.82 64.39.106.120 64.39.98.36 45.155.204.183 34.22 |
| ipv4 | 59.12.193.82 | .4 142.93.153.4 178.128.172.249 79.165.90.196 51.79.142.118 59.12.193.82 64.39.106.120 64.39.98.36 45.155.204.183 34.223.64.22 35.82 |
| ipv4 | 64.39.106.120 | .4 178.128.172.249 79.165.90.196 51.79.142.118 59.12.193.82 64.39.106.120 64.39.98.36 45.155.204.183 34.223.64.22 35.82.51.168 37.237 |
| ipv4 | 64.39.98.36 | .249 79.165.90.196 51.79.142.118 59.12.193.82 64.39.106.120 64.39.98.36 45.155.204.183 34.223.64.22 35.82.51.168 37.237.230.28 44.2 |
| ipv4 | 69.49.228.92 | 162.241.114.189 162.241.69.182 185.246.210.169 94.46.15.22 69.49.228.92 69.49.235.93 3.83.56.46 141.101.146.162 156.146.50.105 156. |
| ipv4 | 69.49.235.93 | 189 162.241.69.182 185.246.210.169 94.46.15.22 69.49.228.92 69.49.235.93 3.83.56.46 141.101.146.162 156.146.50.105 156.146.50.98 185 |
| ipv4 | 79.165.90.196 | 81 185.98.87.200 217.138.216.4 142.93.153.4 178.128.172.249 79.165.90.196 51.79.142.118 59.12.193.82 64.39.106.120 64.39.98.36 45.155 |
| ipv4 | 80.239.140.67 | 62 185.56.80.11 194.126.177.17 192.3.194.202 89.248.173.143 80.239.140.67 47.106.92.240 45.77.138.50 45.86.203.97 27.102.114.78 14.16 |
| ipv4 | 89.248.173.143 | 98 185.254.96.162 185.56.80.11 194.126.177.17 192.3.194.202 89.248.173.143 80.239.140.67 47.106.92.240 45.77.138.50 45.86.203.97 27.10 |
| ipv4 | 94.46.15.22 | 67.99.133.28 162.241.114.189 162.241.69.182 185.246.210.169 94.46.15.22 69.49.228.92 69.49.235.93 3.83.56.46 141.101.146.162 156.14 |
From the original article
3 min read at blog.talosintelligence.com
A recently discovered vulnerability in Apache HTTP Server ( CVE-2021-41733 ) is being actively exploited in the wild. This vulnerability is a path traversal and file disclosure vulnerability that could allow an attacker to map URLs outside of the document root. It could also result in the exposure of the source of interpreted files like CGI scripts.
By Nick Biasini · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.