Welcome! Log In Create A New Profile

Advanced

Re: nginx 0day exploit for nginx + fastcgi PHP

May 22, 2010 08:30AM
On Sat, May 22, 2010 at 08:13:58AM -0400, Ian M. Evans wrote:

> On 5/22/2010 6:49 AM, Ian M. Evans wrote:
> > On 5/22/2010 6:22 AM, Igor Sysoev wrote:
> >> On Sat, May 22, 2010 at 06:17:26AM -0400, Ian M. Evans wrote:
> >>> Yep, the two locations you suggested:
> >>> location ~ ^/(?P<SN>cr...
> >>> and
> >>> location ~ ^(?P<SN>.*/(cr...
> >> I can not reproduce. Do you use 0.8.37 ?
> >
> > Yes...I installed it last night and forgot to restart it, so the old
> > version was still running. Once I finish banging my head on the desk,
> > I'll disable the cgi.fix_pathinfo and make sure all is well.
> >
> > Thanks, and I'll let you know the results.
>
> Well, unfortunately, changing cgi.fix_pathinfo to cgi.fix_pathinfo=0
> killed the extensionless php files, just like it did in 2008.
>
> Here's a snippet from the debug log when it works (cgi.fix_pathinfo=1):
>
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http uri: "/academy/75/photos"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http args: ""
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http exten: ""
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http process request header line
> ...
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: "/"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
> "\.(shtml|php|inc)$"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
> "^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
> "^/(?P<SN>galleries)(?P<PI>/.*$|$)"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http regex set $pi to ""
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http regex set $sn to
> "/academy/75/photos"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 using configuration
> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
> ...
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http script var:
> "/academy/75/photos"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 fastcgi param:
> "SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http script copy: "PATH_INFO"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http script var: ""
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 fastcgi param: "PATH_INFO: "
> ...
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http finalize request: -4,
> "/academy/75/photos?" a:1, c:2
> ...
> 2010/05/22 07:50:52 [debug] 24492#0: *1153 http fastcgi record length: 8184
>
> And here's the same request failing when cgi.fix_pathinfo is turned off:
>
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http uri: "/academy/75/photos"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http args: ""
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http exten: ""
> ...
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
> "\.(shtml|php|inc)$"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
> "^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
> "^/(?P<SN>galleries)(?P<PI>/.*$|$)"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http regex set $pi to ""
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http regex set $sn to
> "/academy/75/photos"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 using configuration
> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
> ...
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http script var:
> "/academy/75/photos"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 fastcgi param:
> "SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http script copy: "PATH_INFO"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http script var: ""
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 fastcgi param: "PATH_INFO: "
> ...
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http finalize request: -4,
> "/academy/75/photos?" a:1, c:2
> ...
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http upstream request:
> "/academy/75/photos?"
> ...
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http finalize request: 404,
> "/academy/75/photos?" a:1, c:1
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http special response: 404,
> "/academy/75/photos?"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 internal redirect:
> "/dhe404.shtml?"
>
> Thanks for any suggestions. What I find interesting (mind-boggling?) is
> that in both instances $pi, $sn, SCRIPT_FILENAME and PATH_INFO are the
> same yet one succeeds and the other tosses a 404.

If you request "/academy/75/photos/" with with cgi.fix_pathinfo=0,
does it work ?


--
Igor Sysoev
http://sysoev.ru/en/

_______________________________________________
nginx mailing list
nginx@nginx.org
http://nginx.org/mailman/listinfo/nginx
Subject Author Posted

nginx 0day exploit for nginx + fastcgi PHP

Avleen Vig May 21, 2010 01:14PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Avleen Vig May 21, 2010 01:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Eren Türkay May 25, 2010 11:44AM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 21, 2010 01:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 01:36PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 01:44PM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 21, 2010 01:52PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 02:16PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian Evans May 21, 2010 02:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 21, 2010 02:40PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 02:40PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 21, 2010 03:10PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 04:46PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian Evans May 21, 2010 04:58PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 05:20PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian Evans May 21, 2010 05:54PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 02:10AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 01:28AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 01:32AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian Evans May 22, 2010 03:00AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 03:58AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 05:46AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 06:12AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 06:22AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 06:26AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 06:56AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 08:22AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 08:30AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 08:48AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 06:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Jérôme Loyet May 21, 2010 03:50PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Weibin Yao May 23, 2010 11:24PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Jérôme Loyet May 24, 2010 03:00AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Weibin Yao May 24, 2010 04:20AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Cliff Wells May 21, 2010 09:00PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Grzegorz Sienko May 21, 2010 09:24PM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 21, 2010 09:34PM

Re: nginx 0day exploit for nginx + fastcgi PHP

gdork January 26, 2011 11:07PM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike January 26, 2011 11:16PM

Re: nginx 0day exploit for nginx + fastcgi PHP

edogawaconan January 27, 2011 12:28AM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike January 27, 2011 01:08AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Cliff Wells May 21, 2010 10:42PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ding Deng May 22, 2010 09:28AM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 22, 2010 03:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

brianmercer May 21, 2010 05:03PM

Re: nginx 0day exploit for nginx + fastcgi PHP

tuurtnt December 14, 2011 06:26PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Kraiser February 17, 2012 09:53AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Reinis Rozitis February 17, 2012 11:42AM

Re: nginx 0day exploit for nginx + fastcgi PHP

zsero October 30, 2012 01:01PM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 69
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 254 on July 05, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready