Executive brief
A vulnerability in the bozohttpd web server, commonly used in NetBSD, allows remote attackers to execute malicious commands on the host system. This occurs when the server is configured to use certain programs to handle dynamic web content that were not designed for that purpose. An attacker can exploit this to gain unauthorized access to the server, potentially leading to a full system compromise or data theft.
Technical details
bozohttpd supports a '-C' option to define CGI handlers for specific file types. The vulnerability arises because the server passes user-supplied arguments from the remote client directly to these handlers. When a non-CGI aware program (such as a shell or the PHP command-line interface) is used as a handler, an attacker can inject command-line arguments to manipulate the program's behavior. This has been demonstrated to allow remote code execution, specifically when using PHP-CLI as a handler. The fix involves removing support for non-CGI aware handlers and upgrading to bozohttpd version 20160415 or later.
Affected products
- NetBSD Foundation NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, 7.0
- NetBSD Foundation bozohttpd versions prior to 20160415
Timeline
- 2015-11-13: disclosed: CVE assigned date
- 2016-04-15: patched: Fixes committed to NetBSD branches and pkgsrc
- 2016-04-21: advisory: NetBSD-SA2016-005 published
- 2017-01-19: other: NVD publication date