Application Details
The Apache HTTP Server is a free and open-source cross-platform web server software.
Vulnerability
Apache HTTP Server could allow a remote attacker to traverse directories on the system, caused by a flaw that was found in a change made to path normalization.
Identification
An attacker could send a specially crafted URL request to map URLs to files outside the expected document root.
POST /cgi-bin/../../../../bin/shPAYLOAD - echo;idDetection
By turning this vulnerability into a traffic file and matching rule, we are able to detect attempts to traverse directories in the application.
Coverage
Idappcom has created signature 8021873 along with a traffic file.
References
Traffic IQ
If you are concerned that your business may be at risk of this vulnerability or others why not try out our Traffic IQ software which can scan your defences and report any issues. Learn more here: https://www.idappcom.co.uk/traffic-iq-professional
Comments