ContentKeeper Web Appliance versions prior to 125.10 expose the mimencode binary via a CGI endpoint, allowing unauthenticated attackers to retrieve arbitrary files from the filesystem. By crafting a POST request to /cgi-bin/ck/mimencode with traversal and output parameters, attackers can read sensitive files such as /etc/passwd outside the webroot.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2009-10005 |
Exploitation
To exploit this vulnerability, an attacker can send a specially crafted POST request to the /cgi-bin/ck/mimencode endpoint, including traversal and output parameters. This allows the attacker to access sensitive files on the server, such as /etc/passwd, without any authentication.
Affected Products
- ContentKeeper Web Appliance versions prior to 125.10: This product is vulnerable due to the exposure of the mimencode binary, which can be exploited to access sensitive files.
Mitigation
To mitigate this vulnerability, it is recommended to update the ContentKeeper Web Appliance to version 125.10 or later, which addresses this issue. Additionally, restricting access to the CGI endpoint and implementing proper authentication mechanisms can help prevent unauthorized access.