CVE-2020-35176: 
NixOS vulnerability analysis and mitigation

CVE-2020-35176 affects AWStats through version 7.8, where the cgi-bin/awstats.pl?config= parameter accepts a partial absolute pathname (omitting the initial /etc), despite being intended to only read files in the /etc/awstats/awstats.conf format. This vulnerability emerged as a result of an incomplete fix for previous vulnerabilities CVE-2017-1000501 and CVE-2020-29600. The issue was discovered in December 2020 (NVD).

The vulnerability is classified as a path traversal attack (CWE-22) with a CVSS v3.1 Base Score of 5.3 (Medium). The attack vector is network-based, requiring low attack complexity with no privileges or user interaction needed. The scope is unchanged, with low confidentiality impact and no impact on integrity or availability. The complete vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows remote unauthenticated attackers to perform path traversal attacks, potentially leading to unauthorized file access outside the intended directory structure. This is particularly concerning in multi-hosting environments where the default configuration file (/etc/awstats/awstats.conf) does not exist (Debian).

The vulnerability can be exploited by sending specially crafted requests to the awstats.pl script with modified config parameter values. The attack requires no special privileges or user interaction, making it relatively straightforward to exploit. The issue becomes exploitable particularly when the default configuration file is not present (GitHub).

Multiple Linux distributions have released patches to address this vulnerability. Debian released version 7.6+dfsg-1+deb9u2 for Debian 9 stretch, Ubuntu provided fixes for multiple versions including 20.04 LTS and 18.04 LTS, and Fedora released version 7.8-2 for Fedora 32 and 33 (Debian, Fedora).