Executive brief
The view-source CGI program, a utility used to display the source code of web files, contains a security flaw that allows unauthorized users to access sensitive files on the server. By using a specific technique to navigate through the server's folders, an attacker can read files they should not have access to, potentially exposing configuration data or system credentials. This could lead to further compromise of the server or the exposure of private information.
Technical details
The view-source CGI program is vulnerable to a directory traversal (path traversal) attack. The vulnerability exists because the program does not properly sanitize user-supplied input in the file path parameter, allowing the use of '..' (dot dot) sequences to escape the intended web directory. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request to read arbitrary files on the host system with the privileges of the web server process. This can result in the disclosure of sensitive system files, configuration files, or source code.
Affected products
- view-source CGI program
Timeline
- 1997-02-01: disclosed: NVD Published Date