Path Traversal Vulnerability in Lighttpd Package - CVE-2018-19052
Summary
CVE-2018-19052: An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. Affects lighttpd across 2 version ranges.
< 1.4.52-1
< 2105dae0f9d7a964375ce681e53cb165375f84c1
Fixed in 1.4.52-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lighttpd is a lightweight open-source web server designed for high-performance environments. It is known for its speed and efficiency, making it a popular choice for serving static and dynamic content. However, prior to version 1.4.50, Lighttpd was susceptible to a path traversal vulnerability that could allow unauthorized access to files outside the intended directory structure.
Vulnerability Detail
CVE-2018-19052 is a path traversal vulnerability found in the mod_alias_physical_handler function within the mod_alias.c file of Lighttpd versions before 1.4.50. The vulnerability arises when a specific mod_alias configuration is used, where the matched alias does not have a trailing '/' character, while the alias target filesystem path does. This misconfiguration can potentially allow an attacker to traverse to a directory above the alias target, leading to unauthorized access to sensitive files on the server. The severity of this vulnerability is rated with a CVSS score of 7.5, indicating a high risk of exploitation.
How To Fix
Minimum fixed version
1.4.52-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lighttpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that all aliases in your Lighttpd configuration end with a trailing '/' character. This can help mitigate the risk of path traversal until the server is updated. For example, modify your configuration as follows:
alias.url = (
"/example/" => "/var/www/example/"
)
Conclusion
CVE-2018-19052 represents a significant security risk for users of Lighttpd versions prior to 1.4.50. It is crucial to update to version 1.4.52 or later to protect against potential path traversal attacks. Additionally, reviewing and adjusting configuration settings can further enhance security.
See every vulnerability recorded for lighttpd →
FAQ
CVE-2018-19052 is a path traversal vulnerability in Lighttpd that allows unauthorized access to files outside the intended directory structure.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Lighttpd versions prior to 1.4.50 are affected by this vulnerability.
The CVSS score of CVE-2018-19052 is 7.5, indicating a high severity level.
If immediate updating is not possible, ensure that your alias configurations end with a trailing '/' to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for lighttpd.
