Executive brief
A sample script included with early web server software allows unauthorized users to view a list of files on the server. This could allow an attacker to discover sensitive configuration files or internal data that should not be publicly visible. While it does not allow an attacker to change files, it provides critical information that can be used to plan further attacks.
Technical details
The vulnerability exists in the 'test-cgi' sample script, which was commonly included in the default CGI-BIN directory of Apache HTTP Server (prior to version 1.3.0) and NCSA Web Server. An unauthenticated remote attacker can exploit this script to perform directory listing on the server. By sending crafted requests to the script, the attacker can enumerate files and directories, potentially leading to the disclosure of sensitive information or system structure. This is a classic information disclosure vulnerability resulting from insecure default sample scripts.
Affected products
- Apache HTTP Server up to 1.3.0
- NCSA NCSA Web Server
Timeline
- 1996-04-01: disclosed: Initial NVD publication date