Apache webserver path traversal attempt for CVE-2021-41773 patterns

title: Apache webserver path traversal attempt for CVE-2021-41773 patterns
id: a9224927-2fd4-419a-936f-92f4df352eef
status: test
description: This rule flags HTTP requests hitting Apache paths that contain URL-encoded traversal sequences (e.g., /.%2e/, /icons/.%2e/, and related variants) and receive a web response status of 200 or 301. Such patterns are commonly used to probe for path normalization weaknesses that can map URLs to resources outside the intended document root. It relies on webserver request telemetry including the full URL query/URI and the HTTP response status observed for those requests.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2021-41773
  - https://github.com/apache/httpd/commit/e150697086e70c552b2588f369f2d17815cb1782
  - https://twitter.com/ptswarm/status/1445376079548624899
  - https://twitter.com/h4x0r_dz/status/1445401960371429381
  - https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/cves/2021/CVE-2021-41773.yaml
  - https://twitter.com/bl4sty/status/1445462677824761878
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-41773/web_cve_2021_41773_apache_path_traversal.yml
author: daffainfo, Florian Roth, Huntrule Team
date: 2021-10-05
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2021-41773
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
      - /cgi-bin/.%2e/
      - /icons/.%2e/
      - /cgi-bin/.%%32%65/
      - /icons/.%%32%65/
      - /cgi-bin/.%%%25%33
      - /icons/.%%%25%33
    sc-status:
      - 200
      - 301
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 3007fec6-e761-4319-91af-e32e20ac43f5
    type: derived