> Apache "mod_alias" URL Validation Canonicalization Vulnerability
> SECUNIA ADVISORY ID:
> VERIFY ADVISORY:
> Less critical
> Security Bypass, Exposure of sensitive information
> From remote
> Apache 2.2.x
> Apache 2.0.x
> Susam Pal has discovered a vulnerability in Apache, which can be
> exploited by malicious people to bypass certain security restrictions
> and disclose potentially sensitive information.
> The vulnerability is caused due to an canonicalization error in the
> "mod_alias" module in the handling of case-sensitive alias directive
> arguments on file systems supporting case-insensitive directory
> names. This can e.g. be exploited to disclose the source code of
> applications placed in the "cgi-bin" directory on certain non-default
> configurations where the ScriptAlias directive references a directory
> inside the document root by accessing an URL with a capital directory
> name (e.g. "CGI-BIN").
> Example of a vulnerable configuration:
> DocumentRoot "[path]/docroot/"
> ScriptAlias /cgi-bin/ "/[path]/docroot/cgi-bin"
> NOTE: This only affects the Microsoft Windows platform.
> The vulnerability has been confirmed in versions 2.0.59 and 2.2.3,
> and has also been reported in version 2.2.2. Other versions may also
> be affected.
> Edit the configuration to ensure that alias directives (e.g.
> ScriptAlias) references directories outside of the document root.
> PROVIDED AND/OR DISCOVERED BY:
> Susam Pal, Infosys Technologies Ltd.