Executive Summary

This vulnerability affects XAMPP version 1.7.3's default WebDAV configuration, where the WebDAV service accessible at /webdav/ uses weak or default authentication credentials. Remote authenticated attackers can exploit this by uploading arbitrary PHP code via HTTP PUT requests without proper authentication controls. Once uploaded, the attacker can execute the malicious PHP code by sending a subsequent HTTP GET request, resulting in remote code execution on the server. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability allows an attacker to remotely upload and execute arbitrary PHP code on the affected server. This can lead to full compromise of the server, including unauthorized access, data theft, modification or deletion of data, and disruption of services. The vulnerability has a high severity score (CVSS 8.7) indicating significant impact on confidentiality, integrity, and availability. [1, 2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the XAMPP WebDAV service is accessible and allows HTTP PUT requests with default or weak credentials. You can attempt to authenticate using default credentials (username: 'wampp', password: 'xampp') against the /webdav/ path. Using tools like curl, you can try to upload a test PHP file via an HTTP PUT request to /webdav/ and check for a successful HTTP 201 Created response. For example, a command to test upload might be: curl -u wampp:xampp -T test.php http://target-server/webdav/test.php -v. If the upload succeeds and the file is accessible via a GET request, the system is vulnerable. [2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling or restricting the WebDAV service on XAMPP if it is not needed, changing default or weak WebDAV authentication credentials to strong, unique passwords, and applying access controls to limit who can access the /webdav/ directory. Additionally, updating XAMPP to a version that patches this vulnerability or applying vendor-provided security updates is recommended. Monitoring and blocking HTTP PUT requests to the /webdav/ path can also help prevent exploitation. [1, 2, 3]

Useful 0 Not Useful 0