Description
The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 4
- Apache 1.3 - Artificially Long Slash Path Directory Listing (2) EDB-20693 · remote · Feb 21, 2002 · verified
- Apache 1.3 - Artificially Long Slash Path Directory Listing (1) EDB-20692 · remote · Jun 13, 2001 · verified
- Apache 1.3 - Artificially Long Slash Path Directory Listing (3) EDB-20694 · remote · Jun 13, 2001 · verified
- Apache 1.3 - Artificially Long Slash Path Directory Listing (4) EDB-20695 · remote · Jun 13, 2001 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20010624 Fw: Bugtraq ID 2503 : Apache Artificially Long Slash Path Directory Listing Exploit mailing-list
- http://www.apacheweek.com/features/security-13
- 20010419 OpenBSD 2.8patched Apache vuln! mailing-list
- ESA-20010620-02 vendor-advisory
- 20010726 Apache Artificially Long Slash Path Directory Listing Vulnerabili ty -- FILE READ ACCESS mailing-list
- apache-slash-directory-listing(6921) vdb-entry
- 20010312 FORW: [ANNOUNCE] Apache 1.3.19 Released mailing-list
- DSA-067 vendor-advisory
- MDKSA-2001:077 vendor-advisory
- 2503 vdb-entry
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list