On 27/08/2010 16:47, zuborg wrote:
> http://myserver/uploads/test.jpg/.php - this attack relyes on some
> php-fcgi feature ?

I *think* it's purely down to use of this configuration stanza:

location ~ \.php$ {
fastcgi_pass myphp;
}

What I try and do as far as possible is use a tighter stanza so that it
only applies to certain files or directories or whatever. I have done
it on a slightly ad-hoc basis so far and used IF statements if I need to
exclude stuff and a tigher regexp in other situations

My implicit question was really because I suspect there is perhaps a
better and more general way to right this generic config assuming:
- large number of arbitrary locations containing PHP files
- some dangerous locations which need to be excluded
- complicated mapping between URIs and file locations

Perhaps someone has a better base config for the above and fastcgi?


Remember the other hint here was that many web apps ship with a bunch of
..htaccess files for apache. It feels very likely that many nginx users
forget to scan for these and translate them into appropriate nginx
configuration. How could we better document that this usually shouldn't
be ignored?

Ed W

_______________________________________________
nginx mailing list
nginx@nginx.org
http://nginx.org/mailman/listinfo/nginx