http://myserver/uploads/test.jpg/.php - this attack relyes on some php-fcgi feature ?

I don't think it will work on 'proxy_pass' to Apache

Actually, there is difference between
location ~ .php$ { }
and
location ~ .php {}

Last one will match 'test.php.jpg', but Apache will still handle such file as image/jpeg, so 'fastcgi_pass' is still required to exploit such configuration.

It also applyes to first exploit too - most installations forbid access to *.php files in upload/ dir by .htaccess, so 'proxy_pass' will return 403 in most cases.


But, again, people using 'fastcgi_pass' should take a look at their configs, they really may be vulnerable.