Welcome! Log In Create A New Profile

Advanced

Re: nginx 0day exploit for nginx + fastcgi PHP

May 21, 2010 01:44PM
On Fri, May 21, 2010 at 09:33:02PM +0400, Igor Sysoev wrote:

> On Fri, May 21, 2010 at 10:07:00AM -0700, Avleen Vig wrote:
>
> > This is currently doing the rounds, so I thought it pertinent to post
> > it here too.
> >
> > http://www.webhostingtalk.com/showthread.php?p=6807475#post6807475
> >
> > I don't know what nginx should do to fix this, but there are two
> > workarounds given.
> > If you allow file uploads (especially things like images) and use PHP
> > FastCGI in the back end, you should take a loot at this now.
> > The exploit allows for any arbitrary file which is uploaded, to be
> > executed as PHP.
>
> I do not see why this is treated as nginx bug ?
> Why is anyone able at all to upload images to /scripts directory ?
> Why does PHP have cgi.fix_pathinfo option ?
> BTW, I'm just curious how does lighttpd resolve this issue ?
>
> Also instead of
>
> if ( $fastcgi_script_name ~ \..*\/.*php ) {
> return 403;
> }
>
> it should be worked around as
>
> location ~ \..*/.*\.php$ {
> return 403;
> }
>
> location ~ \.php$ {
> return 403;

- return 403;
+ fastcgi_pass ...

> }


--
Igor Sysoev
http://sysoev.ru/en/

_______________________________________________
nginx mailing list
nginx@nginx.org
http://nginx.org/mailman/listinfo/nginx
Subject Author Posted

nginx 0day exploit for nginx + fastcgi PHP

Avleen Vig May 21, 2010 01:14PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Avleen Vig May 21, 2010 01:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Eren Türkay May 25, 2010 11:44AM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 21, 2010 01:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 01:36PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 01:44PM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 21, 2010 01:52PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 02:16PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian Evans May 21, 2010 02:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 21, 2010 02:40PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 02:40PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 21, 2010 03:10PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 04:46PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian Evans May 21, 2010 04:58PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 05:20PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian Evans May 21, 2010 05:54PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 02:10AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 01:28AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 01:32AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian Evans May 22, 2010 03:00AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 03:58AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 05:46AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 06:12AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 06:22AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 06:26AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 06:56AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 08:22AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 08:30AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 08:48AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 06:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Jérôme Loyet May 21, 2010 03:50PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Weibin Yao May 23, 2010 11:24PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Jérôme Loyet May 24, 2010 03:00AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Weibin Yao May 24, 2010 04:20AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Cliff Wells May 21, 2010 09:00PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Grzegorz Sienko May 21, 2010 09:24PM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 21, 2010 09:34PM

Re: nginx 0day exploit for nginx + fastcgi PHP

gdork January 26, 2011 11:07PM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike January 26, 2011 11:16PM

Re: nginx 0day exploit for nginx + fastcgi PHP

edogawaconan January 27, 2011 12:28AM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike January 27, 2011 01:08AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Cliff Wells May 21, 2010 10:42PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ding Deng May 22, 2010 09:28AM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 22, 2010 03:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

brianmercer May 21, 2010 05:03PM

Re: nginx 0day exploit for nginx + fastcgi PHP

tuurtnt December 14, 2011 06:26PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Kraiser February 17, 2012 09:53AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Reinis Rozitis February 17, 2012 11:42AM

Re: nginx 0day exploit for nginx + fastcgi PHP

zsero October 30, 2012 01:01PM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 56
Record Number of Users: 8 on December 15, 2016
Record Number of Guests: 386 on August 02, 2016
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready