Executive brief
The aglimpse CGI program, used for searching and indexing files on web servers, contains a flaw that allows unauthorized users to run commands on the host system. This could allow an attacker to take control of the server, access sensitive files, or disrupt web services. Organizations using this legacy search tool should disable it or ensure it is properly patched to prevent remote compromise.
Technical details
A remote command execution vulnerability exists in the aglimpse CGI script, which is part of the Glimpse indexing and search suite. The vulnerability stems from insufficient sanitization of user-supplied input passed to the CGI program, allowing an unauthenticated attacker to inject and execute arbitrary shell commands via the network. This occurs with the privileges of the web server user (e.g., www-data). The flaw is a classic example of command injection in early web-based search interfaces. Mitigation typically involves removing the vulnerable CGI script or upgrading to a version where input is properly escaped.
Affected products
- Glimpse Glimpse aglimpse CGI
Timeline
- 1997-07-01: disclosed: Initial disclosure and NVD publication