[Xitami] Nimda gets a 200?

[Ewen McNeill]

In message <067601c142bd$887362c0$0a00a8c0@enigmacomputers.com>, "Soulkoff" writes:
>This gives a 404:
>http://24.12.24.86/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir

Which is to be expected, you probably don't have a scripts directory,
and even if you do, it's unlikely to have a winnt/system32/cmd.exe file!

>This gives a 200!?:
>http://24.12.24.86/scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir
>
>Do you know what this means?

The 200 is because Xitami finds a page to return.  Your home page.  This
happens under Windows, Linux, etc, although the reason that it happens is
a little bit involved.

The major difference between the two URLs is that the second one has an
illegal %-escape in the URL (the "%%" is illegal; it should be "%nn"
where the "nn" is two hex digits, and "%25" to put a real "%" in).
When Xitami encounters this illegal "%%" it thinks that must be the end
of the "real" URL, because it's found a bit that doesn't make sense.
(To be precise, as a result of the way the routine that decodes the hex
digits is coded, it stores a NUL into the string at that point.)

This gives a URL of: 

http://24.12.24.86/scripts/..

Next Xitami's path resolution code kicks in, which resolves ".." by
eliminating the previous path bit (down to leaving nothing in the URL),
which gives:

http://24.12.24.86/

Hence a 200, serving the default index page.

So, nothing really bad is happening (although it does mean that you'll
send the worm a copy of your index page for each request like that it
sends, which may be a bit more traffic than a 404).

I'll add it to our bug list.  When Xitami finds an illegal escape like
that it should reject it explicitly (with a 404 automatically, or some
sort of malformed request message).

Ewen

-- 
Ewen McNeill, Technical Consultant, iMatix Corporation  www.imatix.com