Secunia

A vulnerability has been reported in Mabry Software HTTPServer/X, which can be exploited by malicious people to gain access to arbitrary files on a vulnerable web server.

The vulnerability is caused due to missing input validation. The HTTPServer/X component ("HttpSrvX.dll" / "HttpSrvX.ocx") doesn't filter the character sequence "../" in a HTTP request, which makes it possible for a malicious person to traverse out of the web root.

Example:
http://[victim]/../../../existing_file

Secunia has confirmed the vulnerability in the latest version (1.00.020). However, prior versions may also be affected.

NOTE: Any web server based on the vulnerable component may be affected.

Solution
Install the web root on a separate drive letter to minimize the impact of traversals. Filter malicious characters in a HTTP proxy or firewall with URL filtering capabilities.

Provided and/or discovered by
dr_insane

Deep Links
Links available in Customer Area