NetServe Web Server v1.0.58 Multiple Remote Vulnerabilities


Vendor: Net-X Solutions Ltd
Product web page: http://www.netxsolutions.co.uk
Affected version: 1.0.58

Summary: NetServe is a super compact Web Server and File Sharing
application for Windows NT, 95, 98, 2000, and XP. It's HTTP Web
Server can serve all types of files including html, gif and jpeg,
actually any files placed in your NetServe directory can be served.
New key features include Server-Side-Include (SSI) support and
CGI/1.1 support giving you the choice of your prefered scripting
language,including but not limited to; Perl, ASP and PHP, to create
your dynamic content.

Desc: NetServe Web Server is vulnerable to multiple vulnerabilities
including cross-site scripting, remote file inclusion, local file
inclusion, script insertion, html injection, denial of service, etc.
Given that the software is not maintained anymore and the last update
was in 2006, there are still a few that uses it. All the parameters
are susceptible to the above attacks. The list of the parameters used
by the web application are(post/get):

- Action
- EnablePasswords
- _Checks
- _ValidationError
- ListIndex
- SiteList_0
- SSIErrorMessage
- SSIExtensions
- SSITimeFormat
- SSIabbrevSize
- EnableSSI
- LogCGIErrors
- LoggingInterval
- ExtendedLogging
- CGITimeOut

The tests were made using PowerFuzzer and OWASP ZAP. No need for PoC
strings. Attackers can exploit any of the issues using a web browser.


Tested on: Microsoft Windows XP Pro SP3 (En)

Vulnerability discovered by Gjoko 'LiquidWorm' Krtic
                            liquidworm gmail com


Advisory ID: ZSL-2011-5021
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5021.php


19.06.2011