Description
ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 expose the mimencode binary via a CGI endpoint, allowing unauthenticated attackers to retrieve arbitrary files from the filesystem. By crafting a POST request to /cgi-bin/ck/mimencode with traversal and output parameters, attackers can read sensitive files such as /etc/passwd outside the webroot.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ContentKeeper Technologies Web Appliance
Default version status: unaffected
0 to < 125.10affected
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/admin/http/contentkeeper_fileaccess.rb ↗
- https://www.exploit-db.com/exploits/16923 ↗
- http://www.aushack.com/200904-contentkeeper.txt ↗
- https://web.archive.org/web/20100325220542/http://www.contentkeeper.com/ ↗
- https://www.vulncheck.com/advisories/contentkeeper-web-appliance-arbitrary-file-access-via-mimencode ↗