Vulnerabilities > CVE-2002-0892 - Path Disclosure vulnerability in NEW Atlanta Communications Servletexec Isapi 4.1

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
low complexity
new-atlanta-communications
nessus
exploit available
NVD
Published: 2002-10-04
Updated: 2008-09-05

Summary

The default configuration of NewAtlanta ServletExec ISAPI 4.1 allows remote attackers to determine the path of the web root via a direct request to com.newatlanta.servletexec.JSP10Servlet without a filename, which leaks the pathname in an error message.

Vulnerable Configurations

Part Description Count
Application
New_Atlanta_Communications
1

Exploit-Db

descriptionNewAtlanta ServletExec/ISAPI 4.1 Path Disclosure Vulnerability. CVE-2002-0892. Remote exploit for windows platform
idEDB-ID:21469
last seen2016-02-02
modified2002-05-22
published2002-05-22
reporterMatt Moore
sourcehttps://www.exploit-db.com/download/21469/
titleNewAtlanta ServletExec/ISAPI 4.1 Path Disclosure Vulnerability

Nessus

NASL familyCGI abuses
NASL idSERVLETEXEC_PATH_DISCLOSURE.NASL
descriptionBy requesting a nonexistent .JSP file, or by invoking the JSPServlet directly and supplying no filename, it is possible to make the ServletExec ISAPI filter disclose the physical path of the webroot.
last seen2020-06-01
modified2020-06-02
plugin id10960
published2002-05-22
reporterThis script is Copyright (C) 2002-2018 Matt Moore
sourcehttps://www.tenable.com/plugins/nessus/10960
titleServletExec 4.1 ISAPI com.newatlanta.servletexec.JSP10Servlet Path Disclosure
code
#
# This script was written by Matt Moore <[email protected]>
#
# Script audit and contributions from Carmichael Security
#      Erik Anderson <[email protected]> (nb: domain no longer exists)
#      Added BugtraqID and CAN
#
# See the Nessus Scripts License for details
#
# Changes by Tenable
# - Updated to use compat.inc (11/20/2009)



include("compat.inc");

if(description)
{
 script_id(10960);
 script_version ("1.22");
 script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/12");

 script_cve_id("CVE-2002-0892");
 script_bugtraq_id(4793);

 script_name(english:"ServletExec 4.1 ISAPI com.newatlanta.servletexec.JSP10Servlet Path Disclosure");
 
 script_set_attribute(attribute:"synopsis", value:
"The remote web server is affected by an information disclosure issue." );
 script_set_attribute(attribute:"description", value:
"By requesting a nonexistent .JSP file, or by invoking the JSPServlet
directly and supplying no filename, it is possible to make the
ServletExec ISAPI filter disclose the physical path of the webroot." );
 script_set_attribute(attribute:"see_also", value:"https://www.westpoint.ltd.uk/advisories/wp-02-0006.txt" );
 script_set_attribute(attribute:"solution", value:
"Use the main ServletExec Admin UI to set a global error page for the
entire ServletExec Virtual Server." );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"false");

 script_set_attribute(attribute:"plugin_publication_date", value: "2002/05/22");
 script_set_attribute(attribute:"vuln_publication_date", value: "2002/05/22");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_end_attributes();

 
 script_summary(english:"Tests for ServletExec 4.1 ISAPI Path Disclosure");
 
 script_category(ACT_GATHER_INFO);
 
 script_copyright(english:"This script is Copyright (C) 2002-2020 Matt Moore");
 script_family(english:"CGI abuses");
 script_dependencie("http_version.nasl");
 script_require_ports("Services/www", 80);
 exit(0);
}

# Check starts here

include("http_func.inc");
include("http_keepalive.inc");

port = get_http_port(default:80, embedded:TRUE);

if(get_port_state(port))
{ 
 req = http_get(item:"/servlet/com.newatlanta.servletexec.JSP10Servlet", port:port);
 r = http_keepalive_send_recv(port:port, data:req);
 confirmed = string("newatlanta");
 confirmedtoo = string("(filename = "); 
 if ((confirmed >< r) && (confirmedtoo ><r))	
 	security_warning(port);

}

References