Welcome! Log In Create A New Profile

Advanced

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans
May 22, 2010 08:22AM
On 5/22/2010 6:49 AM, Ian M. Evans wrote:
> On 5/22/2010 6:22 AM, Igor Sysoev wrote:
>> On Sat, May 22, 2010 at 06:17:26AM -0400, Ian M. Evans wrote:
>>> Yep, the two locations you suggested:
>>> location ~ ^/(?P<SN>cr...
>>> and
>>> location ~ ^(?P<SN>.*/(cr...
>> I can not reproduce. Do you use 0.8.37 ?
>
> Yes...I installed it last night and forgot to restart it, so the old
> version was still running. Once I finish banging my head on the desk,
> I'll disable the cgi.fix_pathinfo and make sure all is well.
>
> Thanks, and I'll let you know the results.

Well, unfortunately, changing cgi.fix_pathinfo to cgi.fix_pathinfo=0
killed the extensionless php files, just like it did in 2008.

Here's a snippet from the debug log when it works (cgi.fix_pathinfo=1):

2010/05/22 07:50:51 [debug] 24492#0: *1153 http uri: "/academy/75/photos"
2010/05/22 07:50:51 [debug] 24492#0: *1153 http args: ""
2010/05/22 07:50:51 [debug] 24492#0: *1153 http exten: ""
2010/05/22 07:50:51 [debug] 24492#0: *1153 http process request header line
....
2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: "/"
2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
"\.(shtml|php|inc)$"
2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
"^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
"^/(?P<SN>galleries)(?P<PI>/.*$|$)"
2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
"^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
2010/05/22 07:50:51 [debug] 24492#0: *1153 http regex set $pi to ""
2010/05/22 07:50:51 [debug] 24492#0: *1153 http regex set $sn to
"/academy/75/photos"
2010/05/22 07:50:51 [debug] 24492#0: *1153 using configuration
"^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
....
2010/05/22 07:50:51 [debug] 24492#0: *1153 http script var:
"/academy/75/photos"
2010/05/22 07:50:51 [debug] 24492#0: *1153 fastcgi param:
"SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
2010/05/22 07:50:51 [debug] 24492#0: *1153 http script copy: "PATH_INFO"
2010/05/22 07:50:51 [debug] 24492#0: *1153 http script var: ""
2010/05/22 07:50:51 [debug] 24492#0: *1153 fastcgi param: "PATH_INFO: "
....
2010/05/22 07:50:51 [debug] 24492#0: *1153 http finalize request: -4,
"/academy/75/photos?" a:1, c:2
....
2010/05/22 07:50:52 [debug] 24492#0: *1153 http fastcgi record length: 8184

And here's the same request failing when cgi.fix_pathinfo is turned off:

2010/05/22 07:53:18 [debug] 24492#0: *1196 http uri: "/academy/75/photos"
2010/05/22 07:53:18 [debug] 24492#0: *1196 http args: ""
2010/05/22 07:53:18 [debug] 24492#0: *1196 http exten: ""
....
2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
"\.(shtml|php|inc)$"
2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
"^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
"^/(?P<SN>galleries)(?P<PI>/.*$|$)"
2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
"^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
2010/05/22 07:53:18 [debug] 24492#0: *1196 http regex set $pi to ""
2010/05/22 07:53:18 [debug] 24492#0: *1196 http regex set $sn to
"/academy/75/photos"
2010/05/22 07:53:18 [debug] 24492#0: *1196 using configuration
"^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
....
2010/05/22 07:53:18 [debug] 24492#0: *1196 http script var:
"/academy/75/photos"
2010/05/22 07:53:18 [debug] 24492#0: *1196 fastcgi param:
"SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
2010/05/22 07:53:18 [debug] 24492#0: *1196 http script copy: "PATH_INFO"
2010/05/22 07:53:18 [debug] 24492#0: *1196 http script var: ""
2010/05/22 07:53:18 [debug] 24492#0: *1196 fastcgi param: "PATH_INFO: "
....
2010/05/22 07:53:18 [debug] 24492#0: *1196 http finalize request: -4,
"/academy/75/photos?" a:1, c:2
....
2010/05/22 07:53:18 [debug] 24492#0: *1196 http upstream request:
"/academy/75/photos?"
....
2010/05/22 07:53:18 [debug] 24492#0: *1196 http finalize request: 404,
"/academy/75/photos?" a:1, c:1
2010/05/22 07:53:18 [debug] 24492#0: *1196 http special response: 404,
"/academy/75/photos?"
2010/05/22 07:53:18 [debug] 24492#0: *1196 internal redirect:
"/dhe404.shtml?"

Thanks for any suggestions. What I find interesting (mind-boggling?) is
that in both instances $pi, $sn, SCRIPT_FILENAME and PATH_INFO are the
same yet one succeeds and the other tosses a 404.

_______________________________________________
nginx mailing list
nginx@nginx.org
http://nginx.org/mailman/listinfo/nginx
Subject Author Posted

nginx 0day exploit for nginx + fastcgi PHP

Avleen Vig May 21, 2010 01:14PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Avleen Vig May 21, 2010 01:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Eren Türkay May 25, 2010 11:44AM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 21, 2010 01:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 01:36PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 01:44PM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 21, 2010 01:52PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 02:16PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian Evans May 21, 2010 02:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 21, 2010 02:40PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 02:40PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 21, 2010 03:10PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 04:46PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian Evans May 21, 2010 04:58PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 05:20PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian Evans May 21, 2010 05:54PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 02:10AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 01:28AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 01:32AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian Evans May 22, 2010 03:00AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 03:58AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 05:46AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 06:12AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 06:22AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 06:26AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 06:56AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 08:22AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 08:30AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 08:48AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 06:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Jérôme Loyet May 21, 2010 03:50PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Weibin Yao May 23, 2010 11:24PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Jérôme Loyet May 24, 2010 03:00AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Weibin Yao May 24, 2010 04:20AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Cliff Wells May 21, 2010 09:00PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Grzegorz Sienko May 21, 2010 09:24PM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 21, 2010 09:34PM

Re: nginx 0day exploit for nginx + fastcgi PHP

gdork January 26, 2011 11:07PM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike January 26, 2011 11:16PM

Re: nginx 0day exploit for nginx + fastcgi PHP

edogawaconan January 27, 2011 12:28AM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike January 27, 2011 01:08AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Cliff Wells May 21, 2010 10:42PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ding Deng May 22, 2010 09:28AM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 22, 2010 03:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

brianmercer May 21, 2010 05:03PM

Re: nginx 0day exploit for nginx + fastcgi PHP

tuurtnt December 14, 2011 06:26PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Kraiser February 17, 2012 09:53AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Reinis Rozitis February 17, 2012 11:42AM

Re: nginx 0day exploit for nginx + fastcgi PHP

zsero October 30, 2012 01:01PM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 95
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 214 on March 20, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready