Lighttpd 'mod_userdir' Case Sensitive Comparison Security Bypass Vulnerability

简介: DescriptionHi,I run lighttpd 1.4.19 on Linux on top of a case-insensitive filesystem (JFS with OS/2 compatibility enabled).

Description

Hi,

I run lighttpd 1.4.19 on Linux on top of a case-insensitive filesystem (JFS with OS/2 compatibility enabled). I noticed that while lighty forces lower case filenames for files within the server.document-root, it doesn't for files in a userdir.

Example:

The original filename is test.php (works):
http://andersman.org/test.php
http://andersman.org/test.PHP

The original filename is test.php (shows sources !!):
http://andersman.org/~anders/test.php
http://andersman.org/~anders/test.PHP

-- anders1

目录
相关文章
|
Unix PHP
Lighttpd < 1.4.23 Source Code Disclosure Vulnerability (BSD/Solaris bug)
Severe vulnerability due to a bug in FreeBSD, OS X and Solaris (
989 0
Lighttpd URI Rewrite/Redirect Information Disclosure Vulnerability
  Description Dear lighty community, I am using lighty to serve a wiki; to have nice urls, i use the following in my lighttpd.
795 0
|
应用服务中间件 nginx
|
关系型数据库 应用服务中间件 Linux
|
应用服务中间件 Apache nginx
|
应用服务中间件 nginx
Secure Multi-party Computation
https://en.wikipedia.org/wiki/Secure_multi-party_computation ...
1049 0