Lighttpd URI Rewrite/Redirect Information Disclosure Vulnerability

 

Description

Dear lighty community,

I am using lighty to serve a wiki; to have nice urls, i use the following in my lighttpd.conf:

url.rewrite-once = ( "^/wiki/(.*)$" => "/wiki/awki.cgi/$1" )

and so i was hoping that everything going through /wiki/ would be interpreted by the script 'awki.cgi'. However, if I url-encode a part of the url, the above rewrite rule does not apply: if I ask my browser to access /wik%69/, lighty does not execute the script and gives me a
listing of files in that directory!

Is there a way to avoid that?
I asked in the forum last week but, as I had no answer, I decided to open a ticket; I apologize if this is unapropriate.

-- gaetan.bisson