man-cgi Local File Inclusion

2018.08.09
Credit: eL_Bart0
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-98

man-cgi before 1.16 allows Local File Inclusion via absolute path traversal. If an Attacker provides a Filename as a Parameter (e.g. https://example.org/cgi-bin/man-cgi?/etc/passwd) the Script will read and return the local file. This is happening because of the way the Script calls the "man" command. Tests have shown that "man /some/random/file" (depending on it's configuration) will first try to locate a manual page for the given Parameter and will fallback to reading the file provided by the Parameter if it wasn't able to find the requested manual page. The Author of the Script was contacted and was kind enough to provide a bugfix Version. You can find the bugfix Version here: http://users.softlab.ntua.gr/~christia/man-cgi.html [Vendor of Product] Panagiotis Christias (http://users.softlab.ntua.gr/~christia/) [Affected Product Code Base] man-cgi < 1.16 [Attack Type] Remote [Impact Information Disclosure] True [Attack Vectors] HTTP(s) Request [Has vendor confirmed or acknowledged the vulnerability?] True


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top