Summary
This host is running Tiny HTTP server and
is prone to arbitrary file disclosure vulnerability.
Impact
Successful exploitation will allow attackers
to perform directory traversal attacks and read arbitrary files on the affected application.
Impact Level: Application
Solution
No solution or patch is available as of 20th
February, 2015. Information regarding this issue will be updated once the solution details are available.
For moreinformation refer to http://tinyserver.sourceforge.net
Insight
The flaw is due to an improper
sanitation of user input via HTTP requests using directory traversal attack (e.g., /../../../).
Affected
Tiny Server version 1.1.9
Detection
Send a crafted request via HTTP GET and
check whether it is able to system files.
References
Updated on 2015-03-25
