WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.
    (CVE-2020-24379)

Note that Nessus relies on the presence of the package as reported by the vendor.

Two vulnerabilities were discovered in yaws, a high performance HTTP 1.1 webserver written in Erlang.

  - CVE-2020-24379     The WebDAV implementation is prone to a XML External     Entity (XXE) injection vulnerability.

  - CVE-2020-24916     The CGI implementation does not properly sanitize CGI     requests allowing a remote attacker to execute arbitrary     shell commands via specially crafted CGI executable     names.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4569-1 advisory.

    It was discovered that Yaws did not properly sanitize XML input. A remote attacker could use this     vulnerability to execute an XML External Entity (XXE) injection attack. (CVE-2020-24379)

    It was discovered that Yaws mishandled certain input when running CGI scripts. A remote attacker could use     this vulnerability to execute arbitrary commands. (CVE-2020-24916)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two issues have been found in yaws, a high performance HTTP 1.1 webserver written in Erlang.

CVE-2020-24379 Reject external resource requests in DAV in order to avoid XML External Entity (XXE) attackes.

CVE-2020-24916 Sanitize CGI executable in order to avoid command injection via CGI requests.

For Debian 9 stretch, these problems have been fixed in version 2.0.4+dfsg-1+deb9u1.

We recommend that you upgrade your yaws packages.

For the detailed security status of yaws please refer to its security tracker page at: https://security-tracker.debian.org/tracker/yaws

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
259555	Linux Distros Unpatched Vulnerability : CVE-2020-24379	Nessus	Misc.	critical
141511	Debian DSA-4773-1 : yaws - security update	Nessus	Debian Local Security Checks	critical
141181	Ubuntu 18.04 LTS : Yaws vulnerabilities (USN-4569-1)	Nessus	Ubuntu Local Security Checks	critical
140810	Debian DLA-2384-1 : yaws security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2020-24379

critical

Tenable Plugins

critical

critical

critical

critical