Abyss Web Server 1.0/1.1 - Authentication Bypass Vulnerability

2003-12-08T00:00:00
ID EDB-ID:23419
Type exploitdb
Reporter Luigi Auriemma
Modified 2003-12-08T00:00:00

Description

Abyss Web Server 1.0/1.1 Authentication Bypass Vulnerability. Remote exploit for windows platform

                                        
                                            source: http://www.securityfocus.com/bid/9171/info

It has been reported that Abyss Web Server is prone to an authentication bypass vulnerability that may allow an attacker to gain access to server resources. This issue may be carried out by accessing a password protected directory under which the server is running by adding a period as '.' or '%2e' at the end of a URL request. This problem only presents itself when the server is installed on a Linux system running FAT32.

Abyss Web Server versions prior to 1.2 have been reported prone to this issue. 

http://www.example.com/protected_FAT32_dir.
http://www.example.com/protected_FAT32_dir./
http://www.example.com/protected_FAT32_dir%2e