Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: Apps :: view-s~1.txt

view-source - ugly hole in the view-source cgi script






From: myst <myst@LIGHT-HOUSE.NET>
Subject: view-source

I've just found a pretty ugly hole in view-source cgi-shell script.

This script, which can be found  on some httpd distributions and
in SCO Skunkware cdroms, is designed to display a given document
located in $DOCUMENT_ROOT/$1 (where $DOCUMENT_ROOT is an
environment variable set by the server).

Unhopefully view-source does not properly check the arguments.

It is therefore possible to display any file on systems where
view-source is world executable by sending something like

'http://www.server.com/cgi-bin/view-source?../../../../../../../etc/passwd'


Obviously this kind of so-called cgi has nothing to do in your cgi-bin
directory... Maybe a day cgi will be secure ;)





TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH