NCSA HTTPd CGI Sample Shell Script Vulnerability

vendor:

HTTPd

by:

SecurityFocus

7.5

CVSS

HIGH

Command Injection

CWE

Product Name: HTTPd

Affected Version From: NCSA HTTPd

Affected Version To: NCSA HTTPd

Patch Exists: Yes

Related CWE: N/A

CPE: a:ncsa:httpd

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: All

2003

NCSA HTTPd CGI Sample Shell Script Vulnerability

NCSA HTTPd and comes with a CGI sample shell script, test-cgi, located by default in /cgi-bin. This script does not properly enclose an 'ECHO' command in quotes, and as a result 'shell expansion' of the * character can occur under some configurations. This allows a remote attacker to obtain file listings, by passing *, /*, /usr/* etc., as variables. The ECHO command expands the * to give a directory listing of the specified directory. This could be used to gain information to facilitate future attacks.

Mitigation:

Enclose the ECHO command in quotes to prevent shell expansion.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/2003/info

NCSA HTTPd and comes with a CGI sample shell script, test-cgi, located by default in /cgi-bin. This script does not properly enclose an "ECHO" command in quotes, and as a result "shell expansion" of the * character can occur under some configurations. This allows a remote attacker to obtain file listings, by passing *, /*, /usr/* etc., as variables. The ECHO command expands the * to give a directory listing of the specified directory. This could be used to gain information to facilitate future attacks. This is identical to a problem with another sample script, nph-test-cgi. See references. 

http://target/cgi-bin/test-cgi?/*
http://target/cgi-bin/test-cgi?*