Apache HTTP server that can be used for file read operations via configuration directives.
apache2 {f} {C} 📎 f 📎 C apache2 {f} {C}Sandbox: execFile · Timeout: 30s
system.file.read network.http.server network.http.serve | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
f | file | No | - | Specify config file path | -f |
C | string | No | - | Pass a config directive | -C |
Inputs
system.file.path Path to file read via config
Outputs
system.file.content File content leaked in error messages
Produces
system.file.contentConsumes
system.file.path| Resource | Value |
|---|---|
| CPU | medium |
| Memory | 64 MB |
| Network | low |
| Disk I/O | low |
Read arbitrary file via config parsing error message
apache2 -f /path/to/input-fileRead arbitrary file via Include directive
apache2 -C 'Define APACHE_RUN_DIR /' -C 'Include /path/to/input-file'Apache HTTP server. When used with sudo or SUID, config file paths passed with -f or -C Include can leak arbitrary file content through error messages.