CVE-2006-1095

Mod_python 3.2.7 Directory Traversal Vulnerability

• CVSS 7.2
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Remote

Directory traversal vulnerability in the FileSession object in Mod_python module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie.

CVE

CVE-2006-1095

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

7.2

Published

2006-03-09

OWASP

A04 Insecure Design

Orthogonal defect classification

Build/Package/Merge

Code defect classification

Packaging Issues

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to Mod_python module version 3.2.10 or higher

import os
import mod_python

def load_session(session_cookie):
    session_path = os.path.join('/path/to/sessions', session_cookie)
    
    if os.path.exists(session_path):
        with open(session_path, 'r') as session_file:
            session_data = session_file.read()
            return session_data
    else:
        return None

import os
import mod_python

def load_session(session_cookie):
    modified_session_cookie = os.path.basename(session_cookie)
    
    session_path = os.path.join('/path/to/sessions', modified_session_cookie)
    
    if os.path.exists(session_path):
        with open(session_path, 'r') as session_file:
            session_data = session_file.read()
            return session_data
    else:
        return None

@misc{vaitp:cve20061095,
  title        = {{Mod_python 3.2.7 Directory Traversal Vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2006},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2006-1095},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2006-1095/}}
}