Welcome! Log In Create A New Profile

Re: nginx 0day exploit for nginx + fastcgi PHP

Forum List Message List New Topic Print View

Ian M. Evans

May 22, 2010 08:48AM

On 5/22/2010 8:24 AM, Igor Sysoev wrote:
> On Sat, May 22, 2010 at 08:13:58AM -0400, Ian M. Evans wrote:
>
>> On 5/22/2010 6:49 AM, Ian M. Evans wrote:
>>> On 5/22/2010 6:22 AM, Igor Sysoev wrote:
>>>> On Sat, May 22, 2010 at 06:17:26AM -0400, Ian M. Evans wrote:
>>>>> Yep, the two locations you suggested:
>>>>> location ~ ^/(?P<SN>cr...
>>>>> and
>>>>> location ~ ^(?P<SN>.*/(cr...
>>>> I can not reproduce. Do you use 0.8.37 ?
>>>
>>> Yes...I installed it last night and forgot to restart it, so the old
>>> version was still running. Once I finish banging my head on the desk,
>>> I'll disable the cgi.fix_pathinfo and make sure all is well.
>>>
>>> Thanks, and I'll let you know the results.
>>
>> Well, unfortunately, changing cgi.fix_pathinfo to cgi.fix_pathinfo=0
>> killed the extensionless php files, just like it did in 2008.
>>
>> Here's a snippet from the debug log when it works (cgi.fix_pathinfo=1):
>>
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http uri: "/academy/75/photos"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http args: ""
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http exten: ""
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http process request header line
>> ...
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: "/"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
>> "\.(shtml|php|inc)$"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
>> "^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
>> "^/(?P<SN>galleries)(?P<PI>/.*$|$)"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
>> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http regex set $pi to ""
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http regex set $sn to
>> "/academy/75/photos"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 using configuration
>> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
>> ...
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http script var:
>> "/academy/75/photos"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 fastcgi param:
>> "SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http script copy: "PATH_INFO"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http script var: ""
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 fastcgi param: "PATH_INFO: "
>> ...
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http finalize request: -4,
>> "/academy/75/photos?" a:1, c:2
>> ...
>> 2010/05/22 07:50:52 [debug] 24492#0: *1153 http fastcgi record length: 8184
>>
>> And here's the same request failing when cgi.fix_pathinfo is turned off:
>>
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http uri: "/academy/75/photos"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http args: ""
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http exten: ""
>> ...
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
>> "\.(shtml|php|inc)$"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
>> "^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
>> "^/(?P<SN>galleries)(?P<PI>/.*$|$)"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
>> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http regex set $pi to ""
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http regex set $sn to
>> "/academy/75/photos"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 using configuration
>> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
>> ...
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http script var:
>> "/academy/75/photos"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 fastcgi param:
>> "SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http script copy: "PATH_INFO"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http script var: ""
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 fastcgi param: "PATH_INFO: "
>> ...
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http finalize request: -4,
>> "/academy/75/photos?" a:1, c:2
>> ...
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http upstream request:
>> "/academy/75/photos?"
>> ...
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http finalize request: 404,
>> "/academy/75/photos?" a:1, c:1
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http special response: 404,
>> "/academy/75/photos?"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 internal redirect:
>> "/dhe404.shtml?"
>>
>> Thanks for any suggestions. What I find interesting (mind-boggling?) is
>> that in both instances $pi, $sn, SCRIPT_FILENAME and PATH_INFO are the
>> same yet one succeeds and the other tosses a 404.
>
> If you request "/academy/75/photos/" with with cgi.fix_pathinfo=0,
> does it work ?
>
>

Adding the trailing slash still produced a 404.

2010/05/22 08:35:22 [debug] 24492#0: *1744 http uri: "/academy/75/photos/"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http args: ""
2010/05/22 08:35:22 [debug] 24492#0: *1744 http exten: ""
2010/05/22 08:35:22 [debug] 24492#0: *1744 http process request header line
2010/05/22 08:35:22 [debug] 24492#0: *1744 test location: ~
"\.(shtml|php|inc)$"
2010/05/22 08:35:22 [debug] 24492#0: *1744 test location: ~
"^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
2010/05/22 08:35:22 [debug] 24492#0: *1744 test location: ~
"^/(?P<SN>galleries)(?P<PI>/.*$|$)"
2010/05/22 08:35:22 [debug] 24492#0: *1744 test location: ~
"^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http regex set $pi to "/"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http regex set $sn to
"/academy/75/photos"
2010/05/22 08:35:22 [debug] 24492#0: *1744 using configuration
"^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http script copy:
"SCRIPT_FILENAME"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http script var:
"/usr/local/apache/htdocs"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http script var:
"/academy/75/photos"
2010/05/22 08:35:22 [debug] 24492#0: *1744 fastcgi param:
"SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http script copy: "PATH_INFO"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http script var: "/"
2010/05/22 08:35:22 [debug] 24492#0: *1744 fastcgi param: "PATH_INFO: /"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http finalize request: -4,
"/academy/75/photos/?" a:1, c:2
2010/05/22 08:35:22 [debug] 24492#0: *1744 http upstream request:
"/academy/75/photos/?"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi header: "Status:
404 Not Found"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi parser: 0
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi header:
"X-Powered-By: PHP/5.2.5"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi parser: 0
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi header:
"Content-type: text/html"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi parser: 1
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi header done
2010/05/22 08:35:22 [debug] 24492#0: *1744 finalize http upstream
request: 404
2010/05/22 08:35:22 [debug] 24492#0: *1744 finalize http fastcgi request
2010/05/22 08:35:22 [debug] 24492#0: *1744 free rr peer 1 0
2010/05/22 08:35:22 [debug] 24492#0: *1744 close http upstream
connection: 13
2010/05/22 08:35:22 [debug] 24492#0: *1744 event timer del: 13: 3221463051
2010/05/22 08:35:22 [debug] 24492#0: *1744 rtsig del connection: fd:13
2010/05/22 08:35:22 [debug] 24492#0: *1744 http finalize request: 404,
"/academy/75/photos/?" a:1, c:1
2010/05/22 08:35:22 [debug] 24492#0: *1744 http special response: 404,
"/academy/75/photos/?"
2010/05/22 08:35:22 [debug] 24492#0: *1744 internal redirect:
"/dhe404.shtml?"

_______________________________________________
nginx mailing list
nginx@nginx.org
http://nginx.org/mailman/listinfo/nginx

Reply Quote

RSS

Subject	Author	Posted
nginx 0day exploit for nginx + fastcgi PHP	Avleen Vig	May 21, 2010 01:14PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Avleen Vig	May 21, 2010 01:30PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Eren Türkay	May 25, 2010 11:44AM
Re: nginx 0day exploit for nginx + fastcgi PHP	mike	May 21, 2010 01:30PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Igor Sysoev	May 21, 2010 01:36PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Igor Sysoev	May 21, 2010 01:44PM
Re: nginx 0day exploit for nginx + fastcgi PHP	mike	May 21, 2010 01:52PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Igor Sysoev	May 21, 2010 02:16PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Ian Evans	May 21, 2010 02:30PM
Re: nginx 0day exploit for nginx + fastcgi PHP	mike	May 21, 2010 02:40PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Igor Sysoev	May 21, 2010 02:40PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Ian M. Evans	May 21, 2010 03:10PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Igor Sysoev	May 21, 2010 04:46PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Ian Evans	May 21, 2010 04:58PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Igor Sysoev	May 21, 2010 05:20PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Ian Evans	May 21, 2010 05:54PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Igor Sysoev	May 22, 2010 02:10AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Ian M. Evans	May 22, 2010 01:28AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Igor Sysoev	May 22, 2010 01:32AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Ian Evans	May 22, 2010 03:00AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Igor Sysoev	May 22, 2010 03:58AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Ian M. Evans	May 22, 2010 05:46AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Igor Sysoev	May 22, 2010 06:12AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Ian M. Evans	May 22, 2010 06:22AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Igor Sysoev	May 22, 2010 06:26AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Ian M. Evans	May 22, 2010 06:56AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Ian M. Evans	May 22, 2010 08:22AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Igor Sysoev	May 22, 2010 08:30AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Ian M. Evans	May 22, 2010 08:48AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Ian M. Evans	May 22, 2010 06:30PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Jérôme Loyet	May 21, 2010 03:50PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Weibin Yao	May 23, 2010 11:24PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Jérôme Loyet	May 24, 2010 03:00AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Weibin Yao	May 24, 2010 04:20AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Cliff Wells	May 21, 2010 09:00PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Grzegorz Sienko	May 21, 2010 09:24PM
Re: nginx 0day exploit for nginx + fastcgi PHP	mike	May 21, 2010 09:34PM
Re: nginx 0day exploit for nginx + fastcgi PHP	gdork	January 26, 2011 11:07PM
Re: nginx 0day exploit for nginx + fastcgi PHP	mike	January 26, 2011 11:16PM
Re: nginx 0day exploit for nginx + fastcgi PHP	edogawaconan	January 27, 2011 12:28AM
Re: nginx 0day exploit for nginx + fastcgi PHP	mike	January 27, 2011 01:08AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Cliff Wells	May 21, 2010 10:42PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Ding Deng	May 22, 2010 09:28AM
Re: nginx 0day exploit for nginx + fastcgi PHP	mike	May 22, 2010 03:30PM
Re: nginx 0day exploit for nginx + fastcgi PHP	brianmercer	May 21, 2010 05:03PM
Re: nginx 0day exploit for nginx + fastcgi PHP	tuurtnt	December 14, 2011 06:26PM
Re: nginx 0day exploit for nginx + fastcgi PHP	Kraiser	February 17, 2012 09:53AM
Re: nginx 0day exploit for nginx + fastcgi PHP	Reinis Rozitis	February 17, 2012 11:42AM
Re: nginx 0day exploit for nginx + fastcgi PHP	zsero	October 30, 2012 01:01PM

Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 135

Record Number of Users: 8 on April 13, 2023

Record Number of Guests: 500 on July 15, 2024