Welcome! Log In Create A New Profile

Advanced

Nginx+Php-fpm Dangerous Bug

December 03, 2011 03:26AM
This is very dangerous Remote File Inclusion Bug in Nginx+php-fpm
The Nginx+php-fpm shows dangerous bug because its allowed the PhpShell hidden in Image to Running,

if you have php script like this:
------------------------------------------------------------------------------------------------------------
<?php

$rfi = $_GET['call'];
include($rfi);
?>
---------------------------------------------------------------------------------------------------------

and the Php-shell formed in image(jpg/gif) can be executed to running with command like this
http://www.your-domain.com/script.php?call=phpshell.jpg
but it doesnt affect when i tried on Apache

as an example you can see here:

http://www.ceriwis.org/rfi.php?hal=ass.jpg <------------ using NGINX and phpshell executed

and

http://ceri.ws/rfi.php?hal=ass.jpg <---------------- using Apace and phpshell unable to executed

someone told me i should use:
1.try_files $uri =404; or this:
2.if (!-f $request_filename) { return 404; } or this
3.cgi.fix_pathinfo=0
4.http://cnedelcu.blogspot.com/2010/05/nginx-php-via-fastcgi-important.html
5.Igor sysoev tips : http://forum.nginx.org/read.php?2,88845,88858#msg-88858
but all of them won't work, i still can access http://www.ceriwis.org/rfi.php?hal=ass.jpg and the phpshell still appear.

im using Nginx 0.8.53 and php-fpm i got my website hacked 3 times by this bug
i hope someone knows what to do with this situation because i think this is serious bug and there will be many victims if this thing not solved.

thanks


Please give me solution. thanks
Subject Author Posted

Nginx+Php-fpm Dangerous Bug

escavern December 03, 2011 03:26AM

Re: Nginx+Php-fpm Dangerous Bug

António P. P. Almeida December 03, 2011 03:48AM

Re: Nginx+Php-fpm Dangerous Bug

escavern December 03, 2011 03:58AM

Re: Nginx+Php-fpm Dangerous Bug

escavern December 03, 2011 04:05AM

Re: Nginx+Php-fpm Dangerous Bug

Edho Arief December 03, 2011 04:06AM

Re: Nginx+Php-fpm Dangerous Bug

escavern December 03, 2011 04:09AM

Re: Nginx+Php-fpm Dangerous Bug

Edho Arief December 03, 2011 04:24AM

Re: Nginx+Php-fpm Dangerous Bug

Jérôme Loyet December 03, 2011 04:32AM

Re: Nginx+Php-fpm Dangerous Bug

escavern December 03, 2011 04:48AM

Re: Nginx+Php-fpm Dangerous Bug

Oleksandr V. Typlyns'kyi December 03, 2011 05:02AM

Re: Nginx+Php-fpm Dangerous Bug

escavern December 03, 2011 05:12AM

Re: Nginx+Php-fpm Dangerous Bug

escavern December 03, 2011 05:14AM

Re: Nginx+Php-fpm Dangerous Bug

locojohn December 03, 2011 07:49AM

Re: Nginx+Php-fpm Dangerous Bug

escavern December 03, 2011 10:37AM

Re: Nginx+Php-fpm Dangerous Bug

escavern December 03, 2011 04:47AM

Re: Nginx+Php-fpm Dangerous Bug

Oleksandr V. Typlyns'kyi December 03, 2011 04:14AM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 71
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready