The buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source code for CGI and FastCGI scripts via a URL with a %00 (null) character after the file extension.

The lighttpd website reports :

In lighttpd 1.3.7 and below it is possible to fetch the source files which should be handled by CGI or FastCGI applications.

The vulnerability is in the handling of urlencoded trailing NUL bytes.
Installations that do not use CGI or FastCGI are not affected.

According to its banner, the version of lighttpd running on the remote host is prior to 1.3.8. It is, therefore, affected by an information disclosure vulnerability. An unauthenticated, remote attacker can exploit this vulnerability, by requesting a CGI script that is appended by a '%00', to read the source of the script.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200502-21 (lighttpd: Script source disclosure)

    lighttpd uses file extensions to determine which elements are programs     that should be executed and which are static pages that should be sent     as-is. By appending %00 to the filename, you can evade the extension     detection mechanism while still accessing the file.
  Impact :

    A remote attacker could send specific queries and access the source of     scripts that should have been executed as CGI or FastCGI applications.
  Workaround :

    There is no known workaround at this time.

The remote host is running Lighttpd, a small webserver.  This version of Lighttpd is vulnerable to a flaw where an attacker requesting a CGI script appended by a '%00' will be able to read the source of the script.

ID	Name	Product	Family	Severity
19104	FreeBSD : lighttpd -- script source disclosure vulnerability (bdad9ada-8a52-11d9-9e53-000a95bc6fae)	Nessus	FreeBSD Local Security Checks	medium
16475	lighttpd < 1.3.8 Null Byte Request CGI Script Source Code Disclosure	Nessus	Web Servers	medium
16472	GLSA-200502-21 : lighttpd: Script source disclosure	Nessus	Gentoo Local Security Checks	medium
2624	Lighttpd < 1.3.8 CGI Source Disclosure	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2005-0453

critical

Tenable Plugins

medium

medium

medium

medium