CherryPy StaticFilter Directory Traversal Vulnerability
BID:16760
Info
CherryPy StaticFilter Directory Traversal Vulnerability
| Bugtraq ID: | 16760 |
| Class: | Input Validation Error |
| CVE: |
CVE-2006-0847 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 21 2006 12:00AM |
| Updated: | May 30 2006 10:17PM |
| Credit: | Ivo van der Wijk is credited with the discovery of this vulnerability. |
| Vulnerable: |
Gentoo Linux CherryPy CherryPy 2.1 CherryPy CherryPy 2.0 |
| Not Vulnerable: |
CherryPy CherryPy 2.1.1 |
Discussion
CherryPy StaticFilter Directory Traversal Vulnerability
CherryPy is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.
Versions prior to 2.1.1 are vulnerable.
CherryPy is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.
Versions prior to 2.1.1 are vulnerable.
Exploit / POC
CherryPy StaticFilter Directory Traversal Vulnerability
An exploit is not required.
An exploit is not required.
Solution / Fix
CherryPy StaticFilter Directory Traversal Vulnerability
Solution:
The vendor has released version 2.1.1 to address this issue.
CherryPy CherryPy 2.0
CherryPy CherryPy 2.1
Solution:
The vendor has released version 2.1.1 to address this issue.
CherryPy CherryPy 2.0
-
CherryPy CherryPy-2.1.1.tar.gz
http://prdownloads.sourceforge.net/cherrypy/CherryPy-2.1.1.tar.gz?down load
CherryPy CherryPy 2.1
-
CherryPy CherryPy-2.1.1.tar.gz
http://prdownloads.sourceforge.net/cherrypy/CherryPy-2.1.1.tar.gz?down load
References
CherryPy StaticFilter Directory Traversal Vulnerability
References:
References: