Vulnerability record · CVE-1999-1053 · published 13 September 1999
CVE-1999-1053: guestbook.pl SSI filter bypass allows command execution on Apache
Apache · Http Server
guestbook.pl attempts to neutralize user-supplied SSI by stripping text between "<!--" and "-->" delimiters, but Apache 1.3.9 and possibly other versions accept alternative SSI closing sequences. Because the filter only handles the "-->" form, an attacker can submit SSI directives that survive cleansing and are then parsed by the server. This matters because it turns a guestbook input field into a server-side command execution path.
Description
guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote command execution with public exploit references and very high EPSS, though the affected software is legacy and no KEV listing exists.
What it is
guestbook.pl attempts to neutralize user-supplied SSI by stripping text between "<!--" and "-->" delimiters, but Apache 1.3.9 and possibly other versions accept alternative SSI closing sequences. Because the filter only handles the "-->" form, an attacker can submit SSI directives that survive cleansing and are then parsed by the server. This matters because it turns a guestbook input field into a server-side command execution path.
Impact
An attacker can execute arbitrary commands with the privileges of the web server process, leading to full compromise of the host and any data it can reach.
Attack surface
Reached remotely over the network by submitting crafted content to the guestbook script; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction beyond the attacker's own request.
Exploitation
Not listed in CISA KEV and no ransomware association is recorded, but EPSS is very high (0.852, 99.7th percentile) and multiple references are tagged Exploit, indicating public exploit material exists.
What to do
- Apply the vendor patch referenced in the SecurityFocus BID 776 advisory, or upgrade Apache and guestbook.pl to fixed versions.
- Disable SSI (Options -Includes / IncludesNOEXEC) on directories serving guestbook content.
- Replace or retire guestbook.pl if no maintained fixed version is available.
- Sanitize input by rejecting or encoding all SSI directive syntax rather than relying on delimiter stripping.
- Run the web service under a least-privilege account to limit command execution impact.
Detection
- Search web access logs for guestbook submissions containing SSI directives such as <!--#exec, <!--#include or unusual closing sequences.
- Monitor for child processes spawned by the web server user (e.g., shell or command interpreters) outside normal request handling.
- Alert on outbound connections or file writes originating from the web server process.
- Review guestbook data files for embedded SSI tokens that bypass the "-->" filter.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/archive/1/33674 | Vendor Advisory |
| http://www.securityfocus.com/archive/82/27296 | ExploitVendor Advisory |
| http://www.securityfocus.com/archive/82/27560 | Vendor Advisory |
| http://www.securityfocus.com/bid/776 | ExploitPatchVendor Advisory |
| http://www.securityfocus.com/archive/1/33674 | Vendor Advisory |
| http://www.securityfocus.com/archive/82/27296 | ExploitVendor Advisory |
| http://www.securityfocus.com/archive/82/27560 | Vendor Advisory |
| http://www.securityfocus.com/bid/776 | ExploitPatchVendor Advisory |
Track CVE-1999-1053 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-1999-1053), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
