1090109 - Apache mod_negotiation filename bruteforcing

Status: RESOLVED INVALID

(Core :: General, defect)

Description

[Hammad]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
Build ID: 20141011015303

Steps to reproduce:

mod_negotiation is an Apache module responsible for selecting the document that best matches the clients capabilities, from one of several available documents. If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error containing a pseudo directory listing. This behaviour can help an attacker to learn more about his target, for example, generate a list of base names, generate a list of interesting extensions, look for backup files and so on.


Actual results:

This vulnerability affects Web Server. 

Pattern found: 
<title>406 Not Acceptable</title>
CWE CWE-538 
CVSS Base Score: 5.0 - AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:W/RC:UR 
 Access Vector: Network 
 Access Complexity: Low 
 Authentication: None 
 Confidentiality Impact: Partial 
 Integrity Impact: None 
 Availability Impact: None 
 Exploitability: Proof of concept code 
 Remediation Level: Workaround 
 Report Confidence: Uncorroborated 



Expected results:

Possible information disclosure: directory listing, filename bruteforcing, backup files.
Disable the MultiViews directive from Apache's configuration file and restart Apache.
You can disable MultiViews by creating a .htaccess file containing the following line:

Options -Multiviews

Comment 1

[Reed Loden [:reed]]

Please don't submit untested reports from vulnerability scanners. They are almost always wrong (such as this case).