Web Server Directory Traversal Arbitrary File Access

Critical Nessus Plugin ID 10297

Synopsis

The remote web server is affected by a directory traversal vulnerability.

Description

It appears possible to read arbitrary files on the remote host outside the web server's document directory using a specially crafted URL. An unauthenticated attacker may be able to exploit this issue to access sensitive information to aide in subsequent attacks.

Note that this plugin is not limited to testing for known vulnerabilities in a specific set of web servers. Instead, it attempts a variety of generic directory traversal attacks and considers a product to be vulnerable simply if it finds evidence of the contents of '/etc/passwd' or a Windows 'win.ini' file in the response. It may, in fact, uncover 'new' issues, that have yet to be reported to the product's vendor.

Solution

Contact the vendor for an update, use a different product, or disable the service altogether.

Plugin Details

Severity: Critical

ID: 10297

File Name: web_traversal.nasl

Version: 1.124

Type: remote

Family: Web Servers

Published: 1999/11/05

Updated: 2018/09/17

Dependencies: 10107, 10582, 10386, 17975

Risk Information

Risk Factor: Critical

CVSS Score Source: CVE-2012-0697

CVSS v2.0

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Reference Information

CVE: CVE-2000-0920, CVE-2007-6483, CVE-2008-5315, CVE-2010-1571, CVE-2010-3459, CVE-2010-3460, CVE-2010-3487, CVE-2010-3488, CVE-2010-3743, CVE-2010-4181, CVE-2011-1900, CVE-2011-2524, CVE-2011-4788, CVE-2012-0697, CVE-2012-1464, CVE-2012-5100, CVE-2012-5335, CVE-2012-5344, CVE-2012-5641, CVE-2013-2619, CVE-2013-3304, CVE-2014-3744

BID: 1770, 7308, 7362, 7378, 7544, 7715, 26583, 32412, 40053, 40133, 40680, 43230, 43258, 43356, 43358, 43830, 44393, 44564, 44586, 45599, 45603, 47760, 47842, 47987, 48114, 48926, 51286, 51311, 51399, 52327, 52384, 52541, 56871, 57143, 57313, 58794, 67389, 70760

EDB-ID: 24915, 33428, 35056

CWE: 22