CVE-1999-1053
published 1999-09-13CVE-1999-1053: guestbook.pl cleanses user-inserted SSI commands by removing text between "" separators, which allows remote attackers to execute arbitrary commands when…
PriorityP345high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
85.20%
99.7th percentile
guestbook.pl cleanses user-inserted SSI commands by removing text between "" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | — | — |
| matt_wright | matt_wright_guestbook | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor HTTP POST requests to /cgi-bin/guestbook.pl with SSI-style payloads in the 'comments' parameter. The exploit injects a payload into the comments field using URI-encoded SSI directives. ↗
- →The vulnerability is exploitable only when HTML posting is enabled in guestbook.pl AND the web server has SSI enabled for the '.html' file type. Detection should look for SSI exec directives written into guestbook.html output files. ↗
- →Apache allows SSI closing sequences other than '-->', meaning sanitization that only strips text between '<!--' and '-->' is bypassable. Look for alternative SSI closing sequences in POST body or written to .html files. ↗
- →After exploitation, a follow-up GET request is made to /guestbook/guestbook.html to trigger the injected SSI command. Correlate a POST to guestbook.pl followed by a GET to guestbook.html from the same source. ↗
- ·Exploitation requires two non-default conditions to both be true: HTML posting enabled in guestbook.pl, and SSI handler enabled for .html files on the web server. Neither condition alone is sufficient. ↗
- ·The affected version is guestbook.pl <= 2.3.1. Deployments running newer or patched versions are not affected. ↗
- ·The vulnerability was confirmed on Apache 1.3.9 but may affect other versions due to Apache's support for non-standard SSI closing sequences. ↗
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7fhv-p5jq-2v6f: guestbook
ghsa_unreviewed·2022-04-30
CVE-1999-1053 [HIGH] GHSA-7fhv-p5jq-2v6f: guestbook
guestbook.pl cleanses user-inserted SSI commands by removing text between "" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".
Red Hat
glibc: manual/search.texi lacks a statement about the unspecified tdelete return value upon deletion of a tree's root
vendor_redhat·1999-11-09·CVSS 9.8
CVE-1999-0199 [CRITICAL] CWE-1053 glibc: manual/search.texi lacks a statement about the unspecified tdelete return value upon deletion of a tree's root
glibc: manual/search.texi lacks a statement about the unspecified tdelete return value upon deletion of a tree's root
manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.
Statement: Red Hat Product Security does not feel that this issue has any security impact because the CVE description suggests that a missing statement in the manpage could lead to a generalized developer awareness problem, that in turn could potentially lead to a flaw. Thus, there is no actual exploitable vulnerability reported in this CVE, but rather, the possibility that one cou
No detection rules found.
Exploit-DB
The Matt Wright Guestbook.pl - Arbitrary Command Execution (Metasploit)
exploitdb·2010-07-03
CVE-1999-1053 The Matt Wright Guestbook.pl - Arbitrary Command Execution (Metasploit)
The Matt Wright Guestbook.pl - Arbitrary Command Execution (Metasploit)
---
##
# $Id: guestbook_ssi_exec.rb 9671 2010-07-03 06:21:31Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Matt Wright guestbook.pl Arbitrary Command Execution',
'Description' => %q{
The Matt Wright guestbook.pl [ 'patrick' ],
'License' => MSF_LICENSE,
'Version' => '$Revision: 9671 $',
'References' =>
[
[ 'CVE', '1999-1053' ],
[ 'OSVDB', '84' ],
[ 'BID', '776' ],
],
'Privileged' => false,
'Payload' =>
{
'DisableNops' => true,
'Space' => 1024,
'Compat' =>
{
Exploit-DB
The Matt Wright Guestbook.pl 2.3.1 - Server-Side Include
exploitdb·1999-11-05
CVE-1999-1053 The Matt Wright Guestbook.pl 2.3.1 - Server-Side Include
The Matt Wright Guestbook.pl 2.3.1 - Server-Side Include
---
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Matt Wright guestbook.pl Arbitrary Command Execution',
'Description' => %q{
The Matt Wright guestbook.pl [ 'patrick' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '1999-1053' ],
[ 'OSVDB', '84' ],
[ 'BID', '776' ],
],
'Privileged' => false,
'Payload' =>
{
'DisableNops' => true,
'Space' => 1024,
'Compat' =>
{
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic perl ruby bash telnet',
}
},
Metasploit
Matt Wright guestbook.pl Arbitrary Command Execution
metasploit
Matt Wright guestbook.pl Arbitrary Command Execution
Matt Wright guestbook.pl Arbitrary Command Execution
The Matt Wright guestbook.pl <= v2.3.1 CGI script contains a flaw that may allow arbitrary command execution. The vulnerability requires that HTML posting is enabled in the guestbook.pl script, and that the web server must have the Server-Side Include (SSI) script handler enabled for the '.html' file type. By combining the script weakness with non-default server configuration, it is possible to exploit this vulnerability successfully.
No writeups or analysis indexed.
http://www.securityfocus.com/archive/1/33674http://www.securityfocus.com/archive/82/27296http://www.securityfocus.com/archive/82/27560http://www.securityfocus.com/bid/776http://www.securityfocus.com/archive/1/33674http://www.securityfocus.com/archive/82/27296http://www.securityfocus.com/archive/82/27560http://www.securityfocus.com/bid/776
1999-09-13
Published