---
title: "Faille de sécurité sur Apache « /cgi-bin/.%2e » (CVE-2021-41773)"
url: https://www.cyber-neurones.org/2021/10/faille-de-securite-sur-apache-cgi-bin/
date: 2021-10-15
modified: 2021-10-15
author: "Frederic"
description: "J'ai pu observer deux attaques différentes : 167.71.13.196 - - [15/Oct/2021:01:11:24 +0200] \"GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/hosts HTTP/1.1\" 400 5636 \"-\" \"Lkx-Apache2449TraversalPlugin/0.0.1 (+https://leakix.net/, +https://twitter.com/HaboubiAnis)\" 45.93.201.33 - - [15/Oct/2021:08:16:57 +0200] \"GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1\" 400..."
categories:
  - "Sécurité"
tags:
  - "iptables"
word_count: 107
---

# Faille de sécurité sur Apache « /cgi-bin/.%2e » (CVE-2021-41773)

J'ai pu observer deux attaques différentes :
167.71.13.196 - - [15/Oct/2021:01:11:24 +0200] "GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/hosts HTTP/1.1" 400 5636 "-" "Lkx-Apache2449TraversalPlugin/0.0.1 (+https://leakix.net/, +https://twitter.com/HaboubiAnis)"
45.93.201.33 - - [15/Oct/2021:08:16:57 +0200] "GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1" 400 485 "-" "-"

J'ai donc bloqué les ip :
# iptables -A INPUT -s 167.71.13.196 -j DROP
# iptables -A INPUT -s 45.93.201.33 -j DROP
# /usr/sbin/iptables-save > /etc/iptables/rules.v4

Pour information les IP en question :

| IP Address | Country | Region | City |
| ---------- | ------- | ------ | ---- |
| 167.71.13.196 | Netherlands ![](https://www.iplocation.net/assets/images/flags/nl.gif) | Noord-Holland | Amsterdam |
| ISP | Organization | Latitude | Longitude |
| DigitalOcean LLC | Not Available | 52.3740 | 4.8897 |

| IP Address | Country | Region | City |
| ---------- | ------- | ------ | ---- |
| 45.93.201.33 | Russian Federation ![](https://www.iplocation.net/assets/images/flags/ru.gif) | Moskva | Moscow |
| ISP | Organization | Latitude | Longitude |
| LIR LLC | Not Available | 55.7522 | 37.6156 |

A suivre.