Title: Abyss Web Server Encoded Backslash Directory Traversal Vulnerability
Severity: MODERATE
Description:
Abyss Web Server is a freely available personal web server. It is maintained by Aprelium Technologies and runs on Microsoft Windows operating systems, as well as Linux.
A directory traversal vulnerability has been reported for Abyss Web Server. The issue is related to the failure to properly process the backslash '\', encoded as '%5c', character, which may be used as a directory delimiter under these platforms. By using the URL encoded sequence '%2e%2e%5c', the web root may be escaped.
Exploitation can result in arbitrary system files being sent to a remote attacker. This information may be of value in attempting further attacks against the vulnerable system.
The directory traversal vulnerability was reported for Abyss Web Server for both the Microsoft Windows and Linux operating environment. In a Linux environment, it is only possible to escape immediately out of the web root directory and into the Abyss folder; it is not possible for an attacker to view files residing outside of the Abyss installation folder. However, in a Windows environment the attacker is able to traverse outside of the webroot and into all areas of the filesystem.
Affected Products:
- Aprelium Technologies Abyss Web Server 1.0.0
- Aprelium Technologies Abyss Web Server 1.0.3
References:
- Aprelium Technologies: Abyss Web Server Homepage
- Aprelium Technologies: Patch for Abyss Web Server 1.0.3 released
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
