CVE-2020-29600: 
Linux Debian vulnerability analysis and mitigation

In AWStats through version 7.7, a path traversal vulnerability was discovered in the cgi-bin/awstats.pl script where the config parameter accepts an absolute pathname, despite being intended to only read files in the /etc/awstats/awstats.conf format. This vulnerability (CVE-2020-29600) was identified as an incomplete fix for a previous vulnerability (CVE-2017-1000501) and was disclosed on December 7, 2020 (NVD).

The vulnerability exists in the config parameter handling of awstats.pl, where the script incorrectly accepts and processes absolute pathnames. When the default /etc/awstats/awstats.conf is not present, the application attempts to read the config file from the parameters and accepts files with absolute paths, leading to potential unauthorized file access. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows remote unauthenticated attackers to read arbitrary files on the system through path traversal, potentially exposing sensitive information. When exploited, the attacker could access files outside the intended directory structure, leading to unauthorized information disclosure (Debian LTS).

The vulnerability is easily exploitable by remote attackers without requiring authentication or user interaction. An attacker can exploit this vulnerability by sending a specially crafted request to the awstats.pl script with an absolute pathname in the config parameter (Debian Bug).

The vulnerability was fixed in AWStats version 7.8. Various Linux distributions have released security updates to address this issue: Ubuntu has released fixes for versions 20.10, 20.04 LTS, 18.04 LTS, and 16.04 ESM (Ubuntu Notice), Fedora has released version 7.8-2.fc32 (Fedora Update), and Debian has also provided security updates for affected versions.