NewAtlanta ServletExecISAPI 4.1 - File Disclosure

2002-05-22T00:00:00
ID EXPLOITPACK:0D86AB80A89B00D869BC933450B95B03
Type exploitpack
Reporter Matt Moore
Modified 2002-05-22T00:00:00

Description

NewAtlanta ServletExecISAPI 4.1 - File Disclosure

                                        
                                            source: https://www.securityfocus.com/bid/4795/info

ServletExec/ISAPI is a plug-in Java Servlet/JSP engine for Microsoft IIS. It runs with IIS on Microsoft Windows NT/2000/XP systems.

ServletExec/ISAPI will disclose the contents of arbitrary files within the webroot directory by sending a request containing URL encoded directory traversal sequences. While this will cause the software to serve files within wwwroot that normally would not be served, it does not appear possible to exploit this condition to break out of the webroot.

http://target/servlet/com.newatlanta.servletexec.JSP10Servlet/..%5c..%5c\global.asa