Network Security Tools

Scanning for CGI Vulnerabilities

Web-based CGI scripts often fail to filter malicious input from external programs or users, and are therefore susceptible to input validation attacks. One such vulnerability was found in a CGI script known as counter.exe . The script did not perform proper input validation on its parameters, enabling remote users to access arbitrary files from the host running the web server. The counter.nasl plug-in was written to check for this vulnerability, and its source code is as follows:

# # This script was written by John [e-mail] # # See the Nessus Scripts License for details # if(description) { script_id(11725); script_version ("$Revision: 1.2 $"); script_cve_id("CAN-1999-1030"); script_bugtraq_id(267); name["english"] = "counter.exe vulnerability"; name["francais"] = "Counter.exe vulnerability"; script_name(english:name["english"], francais:name["francais"]); desc["english"] = " The CGI 'counter.exe' exists on this webserver. Some versions of this file are vulnerable to remote exploit. An attacker may make use of this file to gain access to confidential data or escalate their privileges on the Web server. Solution : remove it from the cgi-bin or scripts directory. More info can be found at: http://www.securityfocus.com/bid/267 Risk factor : Serious"; script_description(english:desc["english"]); summary["english"] = "Checks for the counter.exe file"; script_summary(english:summary["english"]); script_category(ACT_MIXED_ATTACK); # ...