Abe Timmerman zml.cgi File Disclosure Vulnerability
BID:3759
Info
Abe Timmerman zml.cgi File Disclosure Vulnerability
| Bugtraq ID: | 3759 |
| Class: | Input Validation Error |
| CVE: |
CVE-2001-1209 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 31 2001 12:00AM |
| Updated: | Jul 11 2009 09:56AM |
| Credit: | Discovered by [email protected] and posted to the BugTraq mailing list on December 31, 2001. |
| Vulnerable: |
Abe Timmerman zml.cgi |
| Not Vulnerable: | |
Discussion
Abe Timmerman zml.cgi File Disclosure Vulnerability
zml.cgi is a perl script which can be used to support server side include directives under Apache. It recognizes a simple set of commands, and allows access to cgi parameters and environment variables. It can run on Linux and Unix systems or any other platform with Apache and Perl support.
zml.cgi accepts as a parameter the file to parse for these ssi directives. This parameter is susceptible to the standard ../ directory traversal attack, allowing arbitrary files to be specified. Although the script attempts to append a .zml extension to any file accessed, appending a null byte to the file name parameter is sufficient to evade this restriction.
The author of the script has reported that this vulnerability does not exist in any published version of ZML, and that the file parameter has never been used by ZML. It is possible that this vulnerability exists in a modified version of ZML published by an unknown third party. If more details become available, this vulnerability will be updated.
zml.cgi is a perl script which can be used to support server side include directives under Apache. It recognizes a simple set of commands, and allows access to cgi parameters and environment variables. It can run on Linux and Unix systems or any other platform with Apache and Perl support.
zml.cgi accepts as a parameter the file to parse for these ssi directives. This parameter is susceptible to the standard ../ directory traversal attack, allowing arbitrary files to be specified. Although the script attempts to append a .zml extension to any file accessed, appending a null byte to the file name parameter is sufficient to evade this restriction.
The author of the script has reported that this vulnerability does not exist in any published version of ZML, and that the file parameter has never been used by ZML. It is possible that this vulnerability exists in a modified version of ZML published by an unknown third party. If more details become available, this vulnerability will be updated.
Exploit / POC
Abe Timmerman zml.cgi File Disclosure Vulnerability
This vulnerability can be exploited with a web browser.
The following example has been provided by [email protected]:
http://www.blackshell.com/cgi-bin/zml.cgi?file=../../../../../../../../../etc/motd%00
This vulnerability can be exploited with a web browser.
The following example has been provided by [email protected]:
http://www.blackshell.com/cgi-bin/zml.cgi?file=../../../../../../../../../etc/motd%00
Solution / Fix
Abe Timmerman zml.cgi File Disclosure Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.