COMMAND
LocalWEB
SYSTEMS AFFECTED
LocalWEB2000
PROBLEM
Following is based on a SNS Research Advisory. LocalWEB2000 is a
HTTP server for the MS Windows suite of operating systems. It's
intended for use as an intranet server by small to medium size
companies.
Adding the string "../" to an URL allows an attacker access to
files outside of the webserver's publishing directory. This
allows read access to any file on the server.
Example:
http://localhost:80/../../../autoexec.bat
reads the file "autoexec.bat" from the partition's root dir (using
default install).
SOLUTION
Vendor has been notified, the problem will be fixed in a future
release. This was tested against LocalWEB2000 v1.1.0.