Check or Attack Name: ScriptAlias

The ScriptAlias directive creates a virtual directory on your server. Any accesses to that virtual directory will be satisfied by returning the output of a CGI server script in that directory. Configuring a web server with a ScriptAlias Directive specifying a directory under DocumentRoot can open a vulnerability on some web servers, allowing a remote attacker to view the source of CGI scripts on the web server. This action may allow a remote attacker to gain access to proprietary CGI code or more easily determine vulnerabilities in existing CGI scripts on a machine. All versions of Apache prior to 1.0 and NCSA prior to and including version 1.5 are affected.

Affected sites should move ScriptAlias directories out of the DocumentRoot or upgrade your server to a version that securely handles ScriptAlias directives.

NCSA HTTPd Development Team, ScriptAlias directive, http://httpd.ncsa.uiuc.edu/docs/setup/srm/ScriptAlias.html