CVE-2018-19052
published 2018-11-07CVE-2018-19052: An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
14.08%
96.2th percentile
An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | lighttpd | < lighttpd 1.4.52-1 (bookworm) | lighttpd 1.4.52-1 (bookworm) |
| lighttpd | lighttpd | < 1.4.50 | 1.4.50 |
| lighttpd | lighttpd | >= 0 < 1.4.52-1 | 1.4.52-1 |
| lighttpd | lighttpd | >= 0 < 1.4.52-1 | 1.4.52-1 |
| lighttpd | lighttpd | >= 0 < 1.4.52-1 | 1.4.52-1 |
| lighttpd | lighttpd | >= 0 < 1.4.52-1 | 1.4.52-1 |
| lighttpd | lighttpd | >= 0 < 1.4.33-1+nmu2ubuntu2.1+esm1 | 1.4.33-1+nmu2ubuntu2.1+esm1 |
| lighttpd | lighttpd | >= 0 < 1.4.35-4ubuntu2.1+esm1 | 1.4.35-4ubuntu2.1+esm1 |
| lighttpd | lighttpd | >= 0 < 1.4.45-1ubuntu3.18.04.1+esm1 | 1.4.45-1ubuntu3.18.04.1+esm1 |
| opensuse | backports_sle | — | — |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| suse | suse_linux_enterprise_server | — | — |
| suse | suse_linux_enterprise_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Path traversal attack pattern: requests containing '../' one directory above an alias target should be flagged when mod_alias is configured without a trailing '/' on the alias match but with a trailing '/' on the target filesystem path ↗
- →Vulnerable component is mod_alias_physical_handler in mod_alias.c within lighttpd; focus detection on lighttpd instances running versions before 1.4.50 ↗
- →The attack vector is network-based (remote attacker); monitor HTTP requests to lighttpd servers for directory traversal sequences targeting paths served via mod_alias ↗
- ·Vulnerability is only exploitable under a specific mod_alias configuration: the alias match string must lack a trailing '/' while the alias target filesystem path must have a trailing '/' — deployments not matching this pattern are not affected ↗
- ·Traversal is limited to a single directory level above the alias target, not arbitrary depth ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f959-jhqc-rqpv: An issue was discovered in mod_alias_physical_handler in mod_alias
ghsa_unreviewed·2022-05-13
CVE-2018-19052 [HIGH] CWE-22 GHSA-f959-jhqc-rqpv: An issue was discovered in mod_alias_physical_handler in mod_alias
An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.
OSV
lighttpd vulnerabilities
osv·2021-03-15·CVSS 7.5
CVE-2015-3200 [HIGH] lighttpd vulnerabilities
lighttpd vulnerabilities
It was discovered that Lighttpd did not properly sanitized the string used in
basic HTTP authentication method. A remote attacker could use this to inject
arbitrary log entries and maybe obtain sensitive information. This issue only
affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2015-3200)
It was discovered that Lighttpd did not properly sanitized the string used in
alias. A remote attacker could use this to access the content of the directory
above the alias and obtain sensitive information. (CVE-2018-19052)
OSV
CVE-2018-19052: An issue was discovered in mod_alias_physical_handler in mod_alias
osv·2018-11-07·CVSS 7.5
CVE-2018-19052 [HIGH] CVE-2018-19052: An issue was discovered in mod_alias_physical_handler in mod_alias
An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.
Ubuntu
Lighttpd vulnerabilities
vendor_ubuntu·2021-03-15·CVSS 7.5
CVE-2015-3200 [HIGH] Lighttpd vulnerabilities
Title: Lighttpd vulnerabilities
Summary: Lighttpd could be made to expose sensitive information over the
network.
It was discovered that Lighttpd did not properly sanitized the string used in
basic HTTP authentication method. A remote attacker could use this to inject
arbitrary log entries and maybe obtain sensitive information. This issue only
affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2015-3200)
It was discovered that Lighttpd did not properly sanitized the string used in
alias. A remote attacker could use this to access the content of the directory
above the alias and obtain sensitive information. (CVE-2018-19052)
Instructions: After a standard system update you need to restart Lighttpd to make
all the necessary changes.
Debian
CVE-2018-19052: lighttpd - An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd...
vendor_debian·2018·CVSS 7.5
CVE-2018-19052 [HIGH] CVE-2018-19052: lighttpd - An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd...
An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.
Scope: local
bookworm: resolved (fixed in 1.4.52-1)
bullseye: resolved (fixed in 1.4.52-1)
forky: resolved (fixed in 1.4.52-1)
sid: resolved (fixed in 1.4.52-1)
trixie: resolved (fixed in 1.4.52-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-19052 lighttpd: path traversal in mod_alias_physical_handler in mod_alias.c
bugzilla·2018-11-12·CVSS 7.5
CVE-2018-19052 [HIGH] CVE-2018-19052 lighttpd: path traversal in mod_alias_physical_handler in mod_alias.c
CVE-2018-19052 lighttpd: path traversal in mod_alias_physical_handler in mod_alias.c
An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.
References:
https://github.com/lighttpd/lighttpd1.4/commit/2105dae0f9d7a964375ce681e53cb165375f84c1
Discussion:
Created lighttpd tracking bugs for this issue:
Affects: epel-6 [bug 1649069]
---
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the
Bugzilla
CVE-2018-19052 lighttpd: path traversal in mod_alias_physical_handler in mod_alias.c [epel-6]
bugzilla·2018-11-12·CVSS 7.5
CVE-2018-19052 [HIGH] CVE-2018-19052 lighttpd: path traversal in mod_alias_physical_handler in mod_alias.c [epel-6]
CVE-2018-19052 lighttpd: path traversal in mod_alias_physical_handler in mod_alias.c [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-6.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following template
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00054.htmlhttps://github.com/lighttpd/lighttpd1.4/commit/2105dae0f9d7a964375ce681e53cb165375f84c1https://lists.debian.org/debian-lts-announce/2022/01/msg00012.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00054.htmlhttps://github.com/lighttpd/lighttpd1.4/commit/2105dae0f9d7a964375ce681e53cb165375f84c1https://lists.debian.org/debian-lts-announce/2022/01/msg00012.html
2018-11-07
Published