CVE-2005-0088

Access to restricted objects in mod_python 2.7.8 and earlier via crafted URL

• CVSS 7.5
• CWE-284: Improper Access Control
• Input Validation and Sanitization
• Remote

The publisher handler for mod_python 2.7.8 and earlier allows remote attackers to obtain access to restricted objects via a crafted URL.

CVE

CVE-2005-0088

CWE

CWE-284: Improper Access Control

CVSS base score

7.5

Published

2005-05-02

OWASP

A01 Broken Access Control

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Input Validation and Sanitization

Subcategory

Insecure Direct Object References (IDOR)

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update to mod_python version 3.5.0 or higher

from mod_python import apache

def handler(req):
    requested_url = req.uri

    req.write(f"Serving content for {requested_url}")
    return apache.OK

from mod_python import apache

def handler(req):
    restricted_objects = ['/admin', '/config']

    requested_url = req.uri

    if requested_url in restricted_objects:
        req.write("Access Denied")
        return apache.HTTP_FORBIDDEN

    req.write("Access Granted")
    return apache.OK

@misc{vaitp:cve20050088,
  title        = {{Access to restricted objects in mod_python 2.7.8 and earlier via crafted URL}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2005},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2005-0088},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2005-0088/}}
}