header-logo
Suggest Exploit
vendor:
Perl Web Server
by:
SecurityFocus
3.3
CVSS
MEDIUM
Path Disclosure
200
CWE
Product Name: Perl Web Server
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: N/A
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Cross-platform
2002

Perl Web Server Path Disclosure Vulnerability

Perl Web Server, an experimental cross-platform web server project, does not prevent a remote user from requesting documents outside the ServerRoot (location of the virtual / directory). This means that if an attacker knows the location of a sensitive file relative to the ServerRoot, he can retrieve the contents of the file by making an HTTP request containing the relative path. To retrieve /etc/password from a vulnerable host, request: http://www.server.com/../../../../etc/passwd The number of ../ path characters will depend on the ServerRoot (location of the virtual / directory) setting.

Mitigation:

Ensure that the ServerRoot is set to a secure location and that the web server is configured to prevent access to sensitive files.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/2648/info

Perl Web Server, an experimental cross-platform web server project, does not prevent a remote user from requesting documents outside the ServerRoot (location of the virtual / directory).

This means that if an attacker knows the location of a sensitive file relative to the ServerRoot, he can retrieve the contents of the file by making an HTTP request containing the relative path. 

o retrieve /etc/password from a vulnerable host, request:

http://www.server.com/../../../../etc/passwd

The number of ../ path characters will depend on the ServerRoot (location of the virtual / directory) setting.

Navigation

Suggest Exploit

Services By CQR