httpd-bugs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject DO NOT REPLY [Bug 21242] New: - Trailing character renders pages with code
Date Tue, 01 Jul 2003 19:07:51 GMT
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=21242>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=21242

Trailing character renders pages with code

           Summary: Trailing character renders pages with code
           Product: Apache httpd-2.0
           Version: 2.0.46
          Platform: PC
        OS/Version: Windows NT/2K
            Status: NEW
          Severity: Normal
          Priority: Other
         Component: mod_access
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: multiphasic@comcast.net


I have been unable to find any documentation on this bug so I am reporting it.
Given a page "index.html" by appending a "." or "<" to the name it will render 
anyway ex. "index.html." and "index.html<" instead of throwing a page not found 
error. The problem is this applies to pages that run code as well.
I am running coldfusion pages "index.cfm" with apache and if a trailing 
character is appended to the page the CODE will be displayed as text rather 
than rendered by coldfusion. This is a BIG security problem.

I have tested apache 2.0.46 fresh install and by itself (no coldfusion) this 
phenomenon occurs.

If this is a misconfiguration on my part then please inform me, but if you were 
unaware of this then I hope i have helped.

Thanks
- Dave

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org


Mime
View raw message