Vulnerability record · CVE-2002-0061 · published 21 March 2002
CVE-2002-0061: Apache HTTP Server on Win32 command injection via batch script arguments
Apache · Http Server
Apache for Win32 before 1.3.24 and 2.0.x before 2.0.34-beta passes arguments to batch (.bat) or .cmd scripts to the shell interpreter (typically cmd.exe) without filtering shell metacharacters such as the pipe character. A remote attacker can inject commands through those arguments, leading to arbitrary command execution on the server. The flaw matters because it gives unauthenticated remote code execution on affected Windows deployments.
Description
Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically cmd.exe.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote command execution with a high EPSS score, though the affected software is legacy and no KEV listing or confirmed public exploit is recorded.
What it is
Apache for Win32 before 1.3.24 and 2.0.x before 2.0.34-beta passes arguments to batch (.bat) or .cmd scripts to the shell interpreter (typically cmd.exe) without filtering shell metacharacters such as the pipe character. A remote attacker can inject commands through those arguments, leading to arbitrary command execution on the server. The flaw matters because it gives unauthenticated remote code execution on affected Windows deployments.
Impact
An attacker can execute arbitrary commands with the privileges of the Apache service account, compromising the web server and potentially the underlying host.
Attack surface
Reachable remotely over the network through HTTP requests that supply arguments to batch or .cmd scripts handled by the server. The CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.50371, 98.856th percentile), and references are vendor advisories, release notes and mailing list posts rather than exploit code, so public exploit availability is not confirmed by this record.
What to do
- Upgrade to Apache 1.3.24 or later, or 2.0.34-beta or later, on Windows hosts.
- Remove or disable CGI handling of .bat and .cmd scripts where not strictly required.
- Avoid passing user-controlled input as arguments to batch or .cmd scripts; validate and reject shell metacharacters such as the pipe character.
- Run the Apache service under a low-privilege account to limit the impact of command execution.
Detection
- Monitor web server and cmd.exe process creation for child processes spawned by Apache, especially shell invocations with pipe characters in arguments.
- Review HTTP request logs for pipe characters or other shell metacharacters in requests targeting .bat or .cmd scripts.
- Audit Windows hosts for Apache versions below 1.3.24 or 2.0.34-beta and for exposed batch script endpoints.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2002-0061 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2002-0061), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
