CVE-2002-1562 in thttpd
Summary
by MITRE
Directory traversal vulnerability in thttpd, when using virtual hosting, allows remote attackers to read arbitrary files via .. (dot dot) sequences in the Host: header.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2025
The vulnerability identified as CVE-2002-1562 represents a critical directory traversal flaw in the thttpd web server software that specifically manifests when virtual hosting is enabled. This vulnerability resides in the server's handling of HTTP requests and directly impacts how the software processes the Host header field, creating an avenue for unauthorized file access that could potentially expose sensitive system information.
The technical flaw exploits the improper validation of the Host header parameter within thttpd's virtual hosting implementation. When attackers craft malicious requests containing .. (dot dot) sequences within the Host header field, the web server fails to properly sanitize or normalize these path traversal sequences before processing file requests. This weakness allows the software to interpret the malicious input as legitimate file paths, enabling attackers to navigate beyond the intended document root directory and access arbitrary files on the server filesystem. The vulnerability specifically affects the server's ability to properly resolve and validate paths when multiple virtual hosts are configured, making it particularly dangerous in multi-tenant hosting environments.
The operational impact of this vulnerability extends beyond simple information disclosure, as it can potentially allow attackers to access sensitive configuration files, authentication credentials, system logs, and other confidential data stored on the server. In environments where thttpd serves multiple virtual hosts, the vulnerability becomes especially problematic as it could enable attackers to access files belonging to other virtual hosts, effectively breaking the isolation that virtual hosting is designed to provide. This cross-tenant data leakage could lead to privilege escalation, credential theft, and further exploitation opportunities within the compromised infrastructure.
The vulnerability aligns with CWE-22, which classifies directory traversal attacks as a common weakness in web applications and servers. From an adversarial perspective, this flaw maps to several ATT&CK techniques including T1083 (File and Directory Discovery) and T1566 (Phishing with Malicious Attachment) where attackers might use the vulnerability to gather intelligence about the target system. The attack vector requires minimal sophistication, making it particularly dangerous as it can be exploited by both automated scanning tools and skilled attackers seeking to compromise web server environments.
Mitigation strategies for this vulnerability should include immediate patching of the thttpd software to address the directory traversal flaw in the Host header handling. Organizations should also implement proper input validation and sanitization measures within their web server configurations, particularly focusing on the Host header field processing. Network-level protections such as firewalls and web application firewalls can help detect and block suspicious Host header patterns containing traversal sequences. Additionally, system administrators should consider implementing proper access controls and limiting the virtual hosting configuration to reduce the attack surface. Regular security audits and penetration testing should be conducted to identify similar vulnerabilities in other web server implementations and ensure that proper security controls are in place to prevent unauthorized file access across all system components.