Apache for Windows Multiple Forward Slash Directory Listing

#%NASL_MIN_LEVEL 70300
#
# This script was written by John Lampe ([email protected])
#

#
# See the Nessus Scripts License for details
#

# Changes by Tenable:
# - script description, more verbose report, check for k < 16 in find_index(), script id [RD]
# - revised title, changed family (9/4/09)

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(10440);
  script_version("1.55");
  script_set_attribute(attribute:"plugin_modification_date", value:"2022/04/11");

  script_cve_id("CVE-2000-0505", "CVE-2001-0729");
  script_bugtraq_id(1284);

  script_name(english:"Apache for Windows Multiple Forward Slash Directory Listing");

  script_set_attribute(attribute:"synopsis", value:
"It is possible to obtain the list of the contents of the remote
directory.");
  script_set_attribute(attribute:"description", value:
"Certain versions of Apache for Win32 have a bug wherein remote users
can list directory entries.  Specifically, by appending multiple /'s
to the HTTP GET command, the remote Apache server will list all files
and subdirectories within the web root (as defined in httpd.conf).");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the most recent version of Apache at www.apache.org");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");

  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2000/05/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2000/06/13");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:http_server");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"Copyright 2000-2022 John [email protected]");

  script_dependencies("apache_http_version.nasl");
  script_require_keys("installed_sw/Apache", "Settings/ThoroughTests");
  script_require_ports("Services/www", 80);

  exit(0);
}



#
# The script code starts here

include("http_func.inc");
include("http_keepalive.inc");
include("global_settings.inc");

if ( ! thorough_tests ) exit(1, "This plugin only runs if the 'Perform thorough tests' setting is enabled.");


global_var port;

function find_index(k) {
    local_var buf, incoming, q, report;

    if(k < 16)k = 17;
    for (q=k-16; q<k; q=q+1) {
            buf = http_get(item:crap(length:q, data:"/"), port:port);
	    incoming = http_keepalive_send_recv(port:port, data:buf);
	    if ( incoming == NULL ) exit(0);
            if ("Index of /" >< incoming)  {
		report = '\nThe contents of / are :\n' + incoming;
                security_warning(port:port, extra:report);
                exit(0);
            }
         
    }
    exit(0, "The web server on port "+port+" is not affected.");
}




port = get_http_port(default:80, embedded:TRUE);

banner = get_http_banner(port:port);
if ( ! banner ) exit(1, "No HTTP banner on port "+port+".");

if ( "Apache" >!< banner  ) exit(0, "The web server on port "+port+" is not Apache.");
if ( !thorough_tests && "Win32" >!< banner )  exit(0, "The web server on port "+port+" is not Apache for Windows.");



req = http_get(item:"/", port:port);
res = http_keepalive_send_recv(port:port, data:req);
if ( res == NULL ) exit(1, "The web server on port "+port+" failed to answer.");
if ( "Index of /" >< res ) exit(0, "Web index for / on port "+port+".");

if(get_port_state(port)) {
    for (i=2; i < 512; i=i+16) {
            buf = http_get(item:crap(length:i, data:"/"), port:port);
	    incoming = http_keepalive_send_recv(port:port, data:buf);
	    if(incoming == NULL)exit(1, "The web server on port "+port+" failed to answer.");
            if ("Forbidden" >< incoming) {
                  find_index(k:i);
            }
        
    }
}