Phusion Webserver Directory Traversal Vulnerability

Phusion Webserver Directory Traversal Vulnerability

Phusion Webserver is a commercial HTTP server that runs on Microsoft Windows 9x/NT/2000 operating systems.

Phusion Webserver is prone to directory traversal attacks. It is possible to break out of wwwroot using triple-dot-slash (.../) sequences containing HTTP-encoded variations of "/" and "\". As a result, a malicious web user may browse web-readable files on the host running the vulnerable software.

This vulnerability may potentially result in the disclosure of sensitive information contained in web-readable files on the host.

It should be noted that webservers normally run with SYSTEM privileges on Microsoft Windows operating systems.