CVE-1999-1051: Medium severity matt wright formhandler.cgi vulnerability
Default configuration in Matt Wright FormHandler.cgi script allows arbitrary directories to be used for attachments, and only restricts access to the /etc/ directory, which allows remote attackers to read arbitrary files via the replymessageattach attachment parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Reconfigure FormHandler.cgi so attachments may only be saved/read from a single designated upload directory (whitelist). Reject or canonicalize paths provided to attachment parameters to prevent use of arbitrary directories and directory traversal; do not rely solely on the default single restriction of /etc/.
FormHandler.cgi attachment directory handling = restrict to a designated upload directory; disallow absolute paths and directory traversal - Configuration
Disable the reply_message_attach feature if it is not required. If it is required, validate and sanitize the reply_message_attach parameter so it cannot reference files outside the permitted upload directory (block absolute paths and path traversal patterns).
FormHandler.cgi reply_message_attach = disabled or validated - Compensating control
If you cannot immediately change the FormHandler configuration, restrict access to the FormHandler.cgi endpoint (for example via webserver access controls, firewall rules, or IP allowlists) and ensure filesystem permissions prevent the web server from reading sensitive files outside the intended upload directory.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1051?
CVE-1999-1051 is considered a moderate severity vulnerability due to the potential for unauthorized file access.
How do I fix CVE-1999-1051?
To fix CVE-1999-1051, ensure the FormHandler.cgi script has proper directory restrictions and is configured to limit attachment paths.
Who is affected by CVE-1999-1051?
CVE-1999-1051 affects users running versions 1.0, 2.0, and 3.0 of Matt Wright's FormHandler.cgi script.
What type of attack can be executed using CVE-1999-1051?
An attacker can exploit CVE-1999-1051 to read arbitrary files on the server by manipulating the reply_message_attach parameter.
Is CVE-1999-1051 still relevant today?
Yes, CVE-1999-1051 remains relevant as it highlights the risks associated with improper file handling in web applications.