Severe vulnerability due to a bug in FreeBSD, OS X and Solaris (<10) filesystems affecting Lighttpd (<1.4.23)
A bug was discovered in the way FreeBSD, OS X and Solaris (prior version 10) handle symlinks appended with a slash (/). Accessing a regular file through a symbolic link with appended slash succeeds because the slash apperently gets silently dropped. On systems that do not expose this behaviour, a call to stat("symlink.php/") or open("symlink.php/") to a symlink pointing to example.php, will not succeed and set errno to ENOTDIR. This is not the case on the systems mentioned. The vulnerability arises when an application filters access to or decides how to handle a file based on a suffix match. An attacker could circumvent normal behaviour by appended a slash to the filename, resulting in said access rules not applying. Lighttpd in versions prior to 1.4.23 was not aware of this bug and therefor can be tricked by an attacker. It decides how to process a request based on suffix rules provided in its config, usually matching "^.*.php$". The attacker can bypass this rule and gain access to the sourcecode of the .php file possibly revealing sensitive information like passwords.
