Two vulnerabilities in Simple HTTPD 1.38

2007-12-0900:00:00

vulners.com

JSON

#######################################################################

                         Luigi Auriemma

Application: Simple HTTPD
http://shttpd.sourceforge.net
Versions: <= 1.38
Platforms: Windows, *nix, QNX, RTEMS
only Windows seems vulnerable
Bugs: A] directory traversal
B] scripts and CGI viewing/downloading
(%20 char found by Shay priel in Jun 2007)
Exploitation: remote
Date: 07 Dec 2007
Author: Luigi Auriemma
e-mail: [email protected]
web: aluigi.org

#######################################################################

1) Introduction
2) Bugs
3) The Code
4) Fix

#######################################################################

===============
1) Introduction

Simple HTTPD (shttpd) is an open source web server created for embedded
systems.

#######################################################################

=======
2) Bugs

A] directory traversal

Using the "…\" pattern is possible to download any file in the disk on
which is located the web root directory.

B] scripts and CGI viewing/downloading

Any script or CGI in the server can be viewed/downloaded instead of
being executed simply appending the chars '+', '.', %20 (this one
reported by Shay priel in the summer 2007), %2e and any other byte (in
hex format too) major than 0x7f to the requested filename.

Note that only Windows seems vulnerable to the above bugs.

#######################################################################