|
Icecast Directory Traversal Vulnerability
GoLLuM.no <gollum@digit-labs.org> provided this example: Mp3-files residing outside the Web catalog can be accessed by replacing ascii-values for each ".", thus using "/%2E%2E/" instead of "/../" will walk one folder downward. Place a mp3-file named "test1.mp3" in the directory below the one you specified in the variable "staticdir". Then write the following in your browser: http://localhost:8000/file/../test1.mp3 - Will fail in getting the file http://localhost:8000/file/%2E%2E/test1.mp3 - Will succeed in getting the file |
|
|
Privacy Statement |
