CVE-1999-0070

published 1996-04-01

CVE-1999-0070: test-cgi program allows an attacker to list files on the server.

Priority P4 30 medium 5 CVSS 2.0

AV N AC L Au N C N I P A N

EXPLOIT

test-cgi program allows an attacker to list files on the server.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
apache	http_server	< 1.3.0	1.3.0

Detection & IOCs extracted from sources · hover to see the quote

path /cgi-bin/test-cgi↗

url http://target/cgi-bin/test-cgi?/*↗

url http://target/cgi-bin/test-cgi?*↗

filename test-cgi↗

filename nph-test-cgi↗

• → Detect HTTP requests to /cgi-bin/test-cgi with query strings containing wildcard characters (* or /*) indicative of shell expansion directory listing attempts. ↗
• → Also monitor for requests to /cgi-bin/nph-test-cgi with the same wildcard query string patterns, as it shares the identical vulnerability. ↗
• → The attack vector is unquoted ECHO command in the shell script causing glob/shell expansion of * in query string parameters; look for query strings matching patterns like ?*, ?/*, ?/usr/* in CGI requests. ↗

• · Shell expansion of the wildcard only occurs under some server configurations; not all deployments of test-cgi will be exploitable. ↗
• · The vulnerable script is a sample/default CGI script shipped with NCSA HTTPd and Apache 0.8.x/1.0.x; its presence in /cgi-bin indicates a default installation that has not been hardened. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.