Rit Research Labs TinyWeb Server Unauthorized Script Disclosure Vulnerability

Bugtraq ID:	10445
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 01 2004 12:00AM
Updated:	Jun 01 2004 12:00AM
Credit:	Disclosure of this issue is credited to Ziv Kamir.
Vulnerable:	Rit Research Labs TinyWeb 1.9.2
Not Vulnerable:

Rit Research Labs TinyWeb Server Unauthorized Script Disclosure Vulnerability

TinyWeb Server is affected by an unauthorized script disclosure vulnerability. This issue is due to an input validation error that allows malicious users to bypass standard web server rules.

This issue will allow an attacker to download or view scripts residing in the 'cgi-bin' directory.

This issue is reported to affect TinyWeb 1.92, it is likely that other versions are also vulnerable.

Rit Research Labs TinyWeb Server Unauthorized Script Disclosure Vulnerability

No exploit is required to leverage this issue. The following proof of concept has been provided:

http://www.example.com/./cgi-bin/targetfile

Rit Research Labs TinyWeb Server Unauthorized Script Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Rit Research Labs TinyWeb Server Unauthorized Script Disclosure Vulnerability

References:

• TinyWeb Product Website (Rit Research Labs)