Title: GoAhead Webserver ASP Script File Source Code Disclosure Vulnerability
Severity: HIGH
Description:
GoAhead WebServer is an open-source embedded webserver that supports Active Server Pages, embedded JavaScript, and SSL authentication and encryption. It is available for various platforms, including Microsoft Windows and Linux variants.
A vulnerability in GoAhead webserver may result in the disclosure of the source code of ASP script files. The vulnerability occurs because the application fails to sanitize HTTP requests.
An attacker can append '%00', '%2f', '%5c', '/', and '\' characters to the end of an HTTP request for a specific ASP file. As a result, GoAhead webserver will disclose the contents of the requested ASP script file to the attacker. The attacker may then use the information obtained to launch further attacks against the vulnerable system.
This issue affects GoAhead 2.1.7 and earlier.
Affected Products:
- GoAhead Software GoAhead WebServer 2.0.0
- GoAhead Software GoAhead WebServer 2.1.0
- GoAhead Software GoAhead WebServer 2.1.1
- GoAhead Software GoAhead WebServer 2.1.2
- GoAhead Software GoAhead WebServer 2.1.3
- GoAhead Software GoAhead WebServer 2.1.4
- GoAhead Software GoAhead WebServer 2.1.5
- GoAhead Software GoAhead WebServer 2.1.6
- GoAhead Software GoAhead WebServer 2.1.7
- Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge
References:
- CERT: Vulnerability Note VU#975041 GoAhead Web Server discloses source code of ASP fil
- GoAhead Software: GoAhead WebServer Product Homepage
- Rockwell Automation: ControlLogix 1756-ENTB/A Ethernet/IP Bridge - Potential Security Vulnerabilities
- US-CERT: Vulnerability Note VU#124059 GoAhead Webserver information disclosure vulnerabil
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
