Executive brief
A sample script included with early web server software allows remote attackers to view a list of files on the server. This could expose sensitive directory structures and file names to unauthorized individuals, potentially aiding in further attacks. The script was intended for testing purposes but poses a security risk if left active on a production server.
Technical details
The nph-test-cgi script, often included as a default sample in early NCSA and Apache web server distributions, fails to properly sanitize input or restrict access to server internals. By sending specially crafted requests to this script, a remote, unauthenticated attacker can trigger directory listings or view information about files on the host system. This is a classic example of a dangerous default configuration where a diagnostic tool provides excessive information to the network. Remediation typically involves removing the script from the cgi-bin directory.
Affected products
- NCSA NCSA HTTPd
- Apache Apache HTTP Server
Timeline
- 1996-12-10: disclosed: Initial publication date in NVD