CGI Generic Path Traversal (extended test)

medium Nessus Plugin ID 46195

Synopsis

Arbitrary files may be accessed or executed on the remote host.

Description

The remote web server hosts CGI scripts that fail to adequately sanitize request strings and are affected by directory traversal or local file inclusion vulnerabilities.

By leveraging this issue, an attacker may be able to read arbitrary files on the web server or execute commands.

Solution

Either restrict access to the vulnerable application or contact the vendor for an update.

See Also

https://en.wikipedia.org/wiki/Directory_traversal

http://projects.webappsec.org/w/page/13246952/Path%20Traversal

http://projects.webappsec.org/w/page/13246949/Null%20Byte%20Injection

http://www.nessus.org/u?70f7aa09

Plugin Details

Severity: Medium

ID: 46195

File Name: torture_cgi_directory_traversal2.nasl

Version: 1.26

Type: remote

Family: CGI abuses

Published: 4/30/2010

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Vulnerability Information

Required KB Items: Settings/ThoroughTests, Settings/enable_web_app_tests

Reference Information

CWE: 21, 22, 632, 715, 723, 813, 928, 932

OWASP: OWASP-AZ-001