Lighttpd 'mod_userdir' Case Sensitive Comparison Security Bypass Vulnerability

Description

Hi,

I run lighttpd 1.4.19 on Linux on top of a case-insensitive filesystem (JFS with OS/2 compatibility enabled). I noticed that while lighty forces lower case filenames for files within the server.document-root, it doesn't for files in a userdir.

Example:

The original filename is test.php (works):
http://andersman.org/test.php
http://andersman.org/test.PHP

The original filename is test.php (shows sources !!):
http://andersman.org/~anders/test.php
http://andersman.org/~anders/test.PHP

-- anders1

lighttpd-1.4.19_force_lowercase_filenames_in_mod_userdir.patch (465 Bytes) kaank, 03/12/2008 06:53 AM