Executive brief
A vulnerability in Apache and NCSA web servers allowed unauthorized users to view the source code of CGI programs. These programs are used to handle dynamic content on websites, and exposing their code could reveal sensitive business logic or credentials. This could lead to further exploitation of the server or the data it processes.
Technical details
This vulnerability is an information disclosure issue (CWE-200) resulting from improper configuration or handling of the ScriptAlias directory in early versions of Apache and NCSA httpd. By sending a specific request to the server, a remote, unauthenticated attacker could bypass the intended execution of CGI scripts and instead download or view their source code. This occurs because the server fails to strictly enforce execution-only permissions on the designated script directory. This exposure can reveal sensitive information such as hardcoded credentials, internal API logic, or other vulnerabilities within the scripts themselves. The issue was addressed in Apache versions 1.0 and later.
Affected products
- Apache HTTP Server before 1.0
- NCSA ncsa_httpd
Timeline
- 1997-01-01: disclosed: Initial publication date