Interactive Story story.pl next Parameter Traversal Arbitrary File Access

high Nessus Plugin ID 10817

Synopsis

It is possible to read arbitrary files on the remote server.

Description

By requesting :

GET /cgi-bin/story.pl?next=../../../file_to_read%00

An attacker may use this flaw to read arbitrary files on this server.

Solution

Upgrade story.pl to the latest version (1.4 or later).

Plugin Details

Severity: High

ID: 10817

File Name: story.nasl

Version: 1.31

Type: remote

Family: CGI abuses

Published: 12/3/2001

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

Vulnerability Information

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Vulnerability Publication Date: 7/15/2001

Reference Information

CVE: CVE-2001-0804

BID: 3028