Executive brief
The htmlscript CGI program, a tool used for processing web scripts, contains a security flaw that allows unauthorized remote users to read files on the server. This could lead to the exposure of sensitive configuration files, system information, or private data stored on the web server. An attacker can exploit this over the internet without needing any special login credentials.
Technical details
The htmlscript CGI program suffers from an information disclosure vulnerability that allows remote attackers to read arbitrary files on the server. The flaw is likely due to insufficient input validation or improper path handling within the CGI script, which enables an attacker to request and retrieve files outside of the intended web directory. This is a network-based attack that requires no authentication and can be executed by sending a specially crafted HTTP request to the vulnerable CGI program. Successful exploitation results in the loss of confidentiality for any files accessible by the web server process.
Affected products
- htmlscript htmlscript CGI
Timeline
- 1998-01-27: disclosed