Description of problem: Apache Multiviews Arbitrary Directory Listing Issue on Red Hat Capsule 6.11 Version-Release number of selected component (if applicable): Capsule 6.11 How reproducible: 100% Steps to Reproduce: ------------------- 1.Try to access the Capsule URL through your browser or using the curl command: curl https://capsule.example.com/?M=A Actual results: -------------- Nessus was able to exploit the issue using the following request : curl https://capsule.example.com/?M=A <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> <html> <head> <title>Index of /</title> </head> <body> <h1>Index of /</h1> <table> <tr><th valign="top"><img src="/icons/blank.gif" alt="[ICO]"></th><th><a href="?C=N;O=D">Name</a></th><th><a href="?C=M;O=A">Last modified</a></th><th><a href="?C=S;O=A">Size</a></th><th><a href="?C=D;O=A">Description</a></th></tr> <tr><th colspan="5"><hr></th></tr> <tr><td valign="top"><img src="/icons/folder.gif" alt="[DIR]"></td><td><a href="cgi-bin/">cgi-bin/</a></td><td align="right">2022-03-22 11:36 </td><td align="right"> - </td><td> </td></tr> <tr><td valign="top"><img src="/icons/folder.gif" alt="[DIR]"></td><td><a href="html/">html/</a></td><td align="right">2022-03-22 11:36 </td><td align="right"> - </td><td> </td></tr> <tr><th colspan="5"><hr></th></tr> </table> </body></html> Expected results: This Nessus vulnerability (CVE-2001-0731 ) should be fixed. Additional info:
Technical details: Today we use /var/www as a document root. This is incorrect and we should use the Pulp static root (as we do with the HTTPS vhost). It was introduced in https://github.com/theforeman/puppet-foreman_proxy_content/commit/76e2a6852d1d2ca33935ccf8a6ab69992c32ec1d and https://github.com/theforeman/puppet-foreman_proxy_content/blob/15616eb59ba64e8d97440575e7c120f3c2e214d5/spec/acceptance/content_standalone_mirror_spec.rb#L35-L39 has a TODO to resolve it. After that we should also look into disabling directory listing. A workaround for this is creating an empty index file: touch /var/www/index.html That doesn't solve any possible security issues, but it tricks naive vulnerability scanners.
*** Bug 2144854 has been marked as a duplicate of this bug. ***
(In reply to Ewoud Kohl van Wijngaarden from comment #1) > A workaround for this is creating an empty index file: > > touch /var/www/index.html > > That doesn't solve any possible security issues, but it tricks naive > vulnerability scanners. It was pointed out that the cgi-bin and html directories are also visible, so a more correct workaround is: touch /var/www/index.html /var/www/cgi-bin/index.html /var/www/html/index.html