1056520 - Apache mod_negotiation filename bruteforcing

Status: RESOLVED DUPLICATE of bug 783125

(Websites Graveyard :: Your Web, defect)

Description

[Justine Edic]

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0 (Beta/Release)
Build ID: 20140716183446

Steps to reproduce:

mod_negotiation is an Apache module responsible for selecting the document that best matches the clients capabilities, from one of several available documents. If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error containing a pseudo directory listing. This behaviour can help an attacker to learn more about his target, for example, generate a list of base names, generate a list of interesting extensions, look for backup files and so on.


Actual results:

Possible information disclosure: directory listing, filename bruteforcing, backup files.


FIX - 
Disable the MultiViews directive from Apache's configuration file and restart Apache.
You can disable MultiViews by creating a .htaccess file containing the following line:

Options -Multiviews



Expected results:

INFORMATION DISCLOSURE AND ATTTACKER CAN BRUTEFORCE THE DIRECTORIES OF YOUR SITE.

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

What specific site are you trying to file this bug against?

Comment 2

[Justine Edic]

www.mozilla.org Sorry for not setting up the settings. Im new to this  site. Thanks!