CVE-2002-1238

Vulnerability

Peter Sandvik's Simple Web Server versions 0.5.1 and earlier contain a path traversal vulnerability. An HTTP request with a sequence of multiple slash characters (e.g., http://www.example.com///file/) causes the server to bypass access controls, allowing access to files that should be restricted.

Exploitation

An attacker can send a crafted HTTP request containing multiple consecutive forward slashes in the URL path, such as ///file/. No authentication or special privileges are required; the attack can be performed remotely over the network.

Impact

Successful exploitation allows an attacker to read arbitrary files on the server, bypassing intended access restrictions. This can lead to disclosure of sensitive information such as configuration files, source code, or other protected data.

Mitigation

No official patch or updated version has been released according to available references. Users should consider upgrading to a newer, unaffected version if available or apply access controls at the network level (e.g., web application firewall rules) to block requests with excessive slashes.