Multiple Vulnerabilities in PWS 0.2.2

[Donato Ferrante]

Donato Ferrante


Application: Pegasi Web Server (PWS)
http://pws.sourceforge.net

Version: 0.2.2

Bugs: Multiple Vulnerabilities

Author: Donato Ferrante
e-mail: fdonato@autistici.org
web: www.autistici.org/fdonato


xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx

1. Description
2. The bugs
3. The code
4. The fix



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx

----------------
1. Description:
----------------

Vendor's Description:

"Pegasi Web Server (PWS) is a multithreading Java Web server. It is
written by students at the PegasiLUG as a project for Networking."



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx

-------------
2. The bugs:
-------------

[1] directory traversal bug: the program doesn't check for malicious
patterns like "/../", so an attacker is able to navigate through
the system simply using a browser.


[2] cross site scripting bug: the user input strings are not filtered
and they will appear in the returned page.



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx

-------------
3. The code:
-------------

To test the vulnerabilities:

[1]

http://[host]:8080/../../../../etc/passwd

or:

http://[host]:8080/../


[2]

http://[host]:8080/<script>alert("Test")</script>



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx

------------
4. The fix:
------------

No fix.
The email addresses provided on the official website seem don't work.


If you want, you can use my following little patch, that should fix
the bugs for this version of Pegasi Web Server:

...
..

[Jan De Luyck]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thursday 11 March 2004 13:42, Donato Ferrante wrote:
> Donato Ferrante
>
>
> Application: Pegasi Web Server (PWS)
> http://pws.sourceforge.net
>
> Version: 0.2.2
>
> Bugs: Multiple Vulnerabilities
>

<snip>

> ------------
> 4. The fix:
> ------------
>
> No fix.
> The email addresses provided on the official website seem don't work.

I'm the original author of PWS, and the email address currently in the docs
doesn't really reflect reality. Using the good old SourceForge address does
work, though.

I believe I have fixed the bugs in the newest release, 0.2.3.=20

http://sourceforge.net/project/showf...package_id=3D=
11629&release_id=3D223416

Jan De Luyck

=2D --
Matrimony isn't a word, it's a sentence.

=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAVIIRUQQOfidJUwQRAtJjAJ9YX8ansGRwWe2PpKlgdl b1H8L+vwCfW8LI
8cYcFWIkW8j3ubtr49wjkCc=3D
=3DKB9n
=2D----END PGP SIGNATURE-----