Mbedthis AppWeb HTTP TRACE Information Disclosure Vulnerability
BID:24456
Info
Mbedthis AppWeb HTTP TRACE Information Disclosure Vulnerability
| Bugtraq ID: | 24456 |
| Class: | Access Validation Error |
| CVE: |
CVE-2007-3008 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 13 2007 12:00AM |
| Updated: | Jun 13 2007 07:49PM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
Embedthis Software Appweb 3.1.2 |
| Not Vulnerable: |
Embedthis Software Appweb 2.2.2 |
Discussion
Mbedthis AppWeb HTTP TRACE Information Disclosure Vulnerability
Mbedthis AppWeb is prone to an information-disclosure vulnerability.
The vulnerability presents itself because the server responds to the HTTP TRACE request by default.
With HTTP TRACE functionality enabled by default, an attacker can compromise user accounts by gaining access to sensitive header information. The attacker may exploit this issue along with other attacks, such as cross-site scripting, to steal cookie-based authentication credentials.
Mbedthis AppWeb is prone to an information-disclosure vulnerability.
The vulnerability presents itself because the server responds to the HTTP TRACE request by default.
With HTTP TRACE functionality enabled by default, an attacker can compromise user accounts by gaining access to sensitive header information. The attacker may exploit this issue along with other attacks, such as cross-site scripting, to steal cookie-based authentication credentials.
Exploit / POC
Mbedthis AppWeb HTTP TRACE Information Disclosure Vulnerability
To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.
To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.
Solution / Fix
Mbedthis AppWeb HTTP TRACE Information Disclosure Vulnerability
Solution:
The vendor released an update to address this issue. Please see the references for more information.
Solution:
The vendor released an update to address this issue. Please see the references for more information.
References
Mbedthis AppWeb HTTP TRACE Information Disclosure Vulnerability
References:
References:
- AppWeb HTTP Server Changelog (Mbedthis Software)
- Mbedthis AppWeb HTTP Server Homepage (Mbedthis Software)