Exploit Abyss Web Server 1.0/1.1 - Authentication Bypass

[Exploiter]

EDB-ID

23419

Проверка EDB

1. Пройдено

Автор

LUIGI AURIEMMA

Тип уязвимости

REMOTE

Платформа

WINDOWS

CVE

N/A

Дата публикации

2003-12-08

source: https://www.securityfocus.com/bid/9171/info

It has been reported that Abyss Web Server is prone to an authentication bypass vulnerability that may allow an attacker to gain access to server resources. This issue may be carried out by accessing a password protected directory under which the server is running by adding a period as '.' or '%2e' at the end of a URL request. This problem only presents itself when the server is installed on a Linux system running FAT32.

Abyss Web Server versions prior to 1.2 have been reported prone to this issue. 

http://www.example.com/protected_FAT32_dir.
http://www.example.com/protected_FAT32_dir./
http://www.example.com/protected_FAT32_dir%2e