Apache HTTP Server Web Path Traversal Attempt via Encoded Traversal Sequences (CVE-2021-41773)
Alerts on Apache requests with encoded traversal strings that return 200/301, consistent with CVE-2021-41773 probing.
- Category
- webserver
- Author
- daffainfo, Florian Roth (SigmaHQ), DRL 1.1
- Published
- 2021-10-05
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags web requests containing encoded path traversal patterns targeting sensitive paths such as /cgi-bin/ and /icons/ that can indicate an attempt to bypass path normalization. The behavior matters because successful traversal can map URLs to files outside the intended document root, potentially exposing interpreted content. It relies on webserver request telemetry that records the queried URI path component (cs-uri-query) and the resulting HTTP status code (200 or 301).
Reporting behind it
- nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-41773
- github.comhttps://github.com/apache/httpd/commit/e150697086e70c552b2588f369f2d17815cb1782
- twitter.comhttps://twitter.com/ptswarm/status/1445376079548624899
- twitter.comhttps://twitter.com/h4x0r_dz/status/1445401960371429381
- github.comhttps://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/cves/2021/CVE-2021-41773.yaml
- twitter.comhttps://twitter.com/bl4sty/status/1445462677824761878
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-41773/web_cve_2021_41773_apache_path_traversal.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Apache HTTP Server Web Path Traversal Attempt via Encoded Traversal Sequences (CVE-2021-41773)
id: a9224927-2fd4-419a-936f-92f4df352eef
status: test
description: This rule flags web requests containing encoded path traversal patterns targeting sensitive paths such as /cgi-bin/ and /icons/ that can indicate an attempt to bypass path normalization. The behavior matters because successful traversal can map URLs to files outside the intended document root, potentially exposing interpreted content. It relies on webserver request telemetry that records the queried URI path component (cs-uri-query) and the resulting HTTP status code (200 or 301).
references:
- https://nvd.nist.gov/vuln/detail/CVE-2021-41773
- https://github.com/apache/httpd/commit/e150697086e70c552b2588f369f2d17815cb1782
- https://twitter.com/ptswarm/status/1445376079548624899
- https://twitter.com/h4x0r_dz/status/1445401960371429381
- https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/cves/2021/CVE-2021-41773.yaml
- https://twitter.com/bl4sty/status/1445462677824761878
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-41773/web_cve_2021_41773_apache_path_traversal.yml
author: daffainfo, Florian Roth, Huntrule Team
date: 2021-10-05
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- cve.2021-41773
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- /cgi-bin/.%2e/
- /icons/.%2e/
- /cgi-bin/.%%32%65/
- /icons/.%%32%65/
- /cgi-bin/.%%%25%33
- /icons/.%%%25%33
sc-status:
- 200
- 301
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 3007fec6-e761-4319-91af-e32e20ac43f5
type: derived