Exploit Jetty 3.1.6/3.1.7/4.1 Servlet Engine - Arbitrary Command Execution

[Exploiter]

EDB-ID

21895

Проверка EDB

1. Пройдено

Автор

MATT MOORE

Тип уязвимости

WEBAPPS

Платформа

CGI

CVE

cve-2002-1178

Дата публикации

2002-10-02

source: https://www.securityfocus.com/bid/5852/info

A flaw in the CGIServlet in Jetty allows an attacker to execute arbitrary commands on the server. Specifically, it is possible for an attacker to use directory traversal sequences and cause the CGIServlet to execute attacker-specified commands (such as running executables on the host).

This vulnerability affects Jetty versions for Microsoft Windows prior to 4.1.0.

http://jetty-server:8080/cgi-bin/..\..\..\..\..\..\winnt/notepad.exe