Bugtraq: Re: Re: CGI Script Source Code Disclosure Vulnerability in Apache for Windows

[nareshhacker () gmail com]

This _is_ a vulnerability.

Even though the common convention is never to include 'cgi-bin' within the document-root, still, many companies put 
'cgi-bin' inside the document-root assuming it to be a safe practice. 

No matter what the common convention is; the fact is, if the cgi-bin directory is marked as a Scripts folder with the 
ScriptAlias 'cgi-bin' (i.e. the same name as the directory), the user should be able to see the contents of the 
directory as scripts only. There shouldn't be any way to bypass the security mechanism to prevent execution of the 
files in that driectory.

IMHO, Apache must come up with a patch so that it can take care of the case-insensitivity of Windows systems rather 
than calling it a mis-configuration so as to provide more flexibility to the Apache admins.

- Naresh
--------------------------------------------------------------------------
> This is not a security vulnerability in the server, but rather a serious
> misconfiguration of the ScriptAlias Directive. ScriptAlias exists to
> allow CGI scripts to be stored in a directory outside of the document
> tree. Common convention is never to include cgi-bin within the document
> tree.
>
> Regards,
> Joe Orton