NCDSA HTTPd nph-test-cgi Arbitrary Directory Listing

medium Nessus Plugin ID 10165

Language:

Synopsis

The remote web server contains a CGI script that is affected by information disclosure vulnerabilities.

Description

The remote web server contains the 'nph-test-cgi' test script, which is included by default with some web servers.

The version of this script on the remote host fails to quote input to several environment variables, such as 'QUERY_STRING', before echoing it back as part of a shell script. An unauthenticated attacker can leverage this issue to list the contents of directories on the remote host, subject to the permissions of the web server user id.

Solution

Disable or delete the CGI script.

Plugin Details

Severity: Medium

ID: 10165

File Name: nph-test-cgi.nasl

Version: 1.33

Type: remote

Family: CGI abuses

Published: 6/22/1999

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

Excluded KB Items: Settings/disable_cgi_scanning

Vulnerability Publication Date: 2/18/1997

Reference Information

CVE: CVE-1999-0045

BID: 686

CERT-CC: CA-1997-07

Detections

Analytics