Apache Double Slash GET Request Forced Directory Listing

This script is Copyright (C) 2003-2014 Tenable Network Security, Inc.


Synopsis :

The remote web server is affected by an information disclosure
vulnerability.

Description :

It is possible to obtain the listing of the content of the remote web
server root by sending the request 'GET // HTTP/1.0' This
vulnerability usually affects the default Apache configuration which
is shipped with Red Hat Linux, although it might affect other Linux
distributions or other web server.

An attacker can exploit this flaw to browse the contents of the remote
web server and possibly find hidden links.

See also :

http://www.securityfocus.com/archive/1/342578/30/0/threaded

Solution :

Create an index file for each directory instead of default welcome
pages.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS Temporal Score : 4.5
(CVSS2#E:F/RL:W/RC:ND)
Public Exploit Available : true

Family: Web Servers

Nessus Plugin ID: 11909 (apache2_double_slash.nasl)

Bugtraq ID: 8898

CVE ID: CVE-2003-1138