Lighttpd URI Rewrite/Redirect Information Disclosure Vulnerability

简介:  DescriptionDear lighty community,I am using lighty to serve a wiki; to have nice urls, i use the following in my lighttpd.

 

Description

Dear lighty community,

I am using lighty to serve a wiki; to have nice urls, i use the following in my lighttpd.conf:

url.rewrite-once = ( "^/wiki/(.*)$" => "/wiki/awki.cgi/$1" )

and so i was hoping that everything going through /wiki/ would be interpreted by the script 'awki.cgi'. However, if I url-encode a part of the url, the above rewrite rule does not apply: if I ask my browser to access /wik%69/, lighty does not execute the script and gives me a
listing of files in that directory!

Is there a way to avoid that?
I asked in the forum last week but, as I had no answer, I decided to open a ticket; I apologize if this is unapropriate.

-- gaetan.bisson

目录
相关文章
|
Unix PHP
Lighttpd < 1.4.23 Source Code Disclosure Vulnerability (BSD/Solaris bug)
Severe vulnerability due to a bug in FreeBSD, OS X and Solaris (
1102 0
|
安全 Linux
Lighttpd 'mod_userdir' Case Sensitive Comparison Security Bypass Vulnerability
Description Hi, I run lighttpd 1.4.19 on Linux on top of a case-insensitive filesystem (JFS with OS/2 compatibility enabled).
918 0
|
应用服务中间件 nginx
|
关系型数据库 应用服务中间件 Linux
|
应用服务中间件 Apache nginx
|
应用服务中间件 nginx

热门文章

最新文章