Posted by sd on Dec 24
The bug is lighttpd's. It's whitelist is applied to actual url (thus
allowing .cgi, .css, .gif etc, according to its whitelist).
However that pesky PATHINFO feature strips all trailing path
components in hopes of finding a valid path
(/admin.cgi/blah.(css|gif|js…)) becomes just /admin.cgi).
Actual trailing paths granting arbitrary CGI access:
airos.allow = (
".ico",
".gif",…
Source: Re: AirOS remote root 0day
