Miva htmlscript 2.x Directory Traversal Vulnerability

Bugtraq ID:	2001
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Jan 26 1998 12:00AM
Updated:	Jan 26 1998 12:00AM
Credit:	First posted to BugTraq on January 26, 1998 by Dennis Moore <[email protected]>
Vulnerable:	Miva htmlscript 2.0
Not Vulnerable:	Miva Miva 1.0 Miva htmlscript 2.9932

Miva htmlscript 2.x Directory Traversal Vulnerability

Miva's htmlscript CGI program provides a unique scripting language with HTML type tags. (Note that htmlscript is an older product no longer distributed by Miva under that name.) Versions of the htmlscript interpreter (a CGI script) prior to 2.9932 are vulnerable to a file reading directory traversal attack using relative paths (eg., "../../../../../../etc/passwd"). An attacker need only append this path as a variable passed to the script via a URL. The contents of any file to which the web server process has read access can be retrieved using this method.

Miva htmlscript 2.x Directory Traversal Vulnerability

Example attack:

http://host/cgi-bin/htmlscript?../../../../../../../etc/somefile

Miva htmlscript 2.x Directory Traversal Vulnerability

Solution:
Version 2.9932 and later are not vulnerable to this attack.

Miva htmlscript 2.x Directory Traversal Vulnerability

References:

• Miva Corporation (Miva Corporation)