首页 > nginx > 转发:Nginx文件类型错误解析漏洞

转发:Nginx文件类型错误解析漏洞

2010年5月24日 eric 发表评论 阅读评论

其实此漏洞并不是Nginx的漏洞,而是PHP PATH_INFO的漏洞,详见:http://bugs.php.net/bug.php?id=50852&edit=1
例如用户上传了一张照片,访问地址为http://www.domain.com/images/test.jpg,而test.jpg文件内的内容实际上是PHP代码时,通过http://www.domain.com/images/test.jpg/abc.php就能够执行该文件内的PHP代码。

网上提供的临时解决方法有:
  方法①、修改php.ini,设置cgi.fix_pathinfo = 0;然后重启php-cgi。此修改会影响到使用PATH_INFO伪静态的应用,例如我以前博文的URL:http://blog.s135.com/read.php/348.htm 就不能访问了。

  方法②、在nginx的配置文件添加如下内容后重启:if ( $fastcgi_script_name ~ \..*\/.*php ) {return 403;}。该匹配会影响类似 http://www.domain.com/software/5.0/test.php(5.0为目录),http://www.domain.com/goto.php/phpwind 的URL访问。

  方法③、对于存储图片的location{…},或虚拟主机server{…},只允许纯静态访问,不配置PHP访问。例如在金山逍遥网论坛、SNS上传的图片、附件,会传送到专门的图片、附件存储服务器集群上(pic.xoyo.com),这组服务器提供纯静态服务,无任何动态PHP配置。各大网站几乎全部进行了图片服务器分离,因此Nginx的此次漏洞对大型网站影响不大。

本人再提供一种修改nginx.conf配置文件的临时解决方法,兼容“http://blog.s135.com/demo/0day/phpinfo.php/test”的PATH_INFO伪静态,拒绝“http://blog.s135.com/demo/0day/phpinfo.jpg/test.php”的漏洞攻击:

location ~* .*\.php($|/)
{
      if ($request_filename ~* (.*)\.php) {
            set $php_url $1;
      }
      if (!-e $php_url.php) {
            return 403;
      }

      fastcgi_pass  127.0.0.1:9000;
      fastcgi_index index.php;
      include fcgi.conf;
}

  也可将以下内容写在fcgi.conf文件中,便于多个虚拟主机引用:

if ($request_filename ~* (.*)\.php) {
    set $php_url $1;
}
if (!-e $php_url.php) {
    return 403;
}

fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
fastcgi_param  SERVER_SOFTWARE    nginx;

fastcgi_param  QUERY_STRING       $query_string;
fastcgi_param  REQUEST_METHOD     $request_method;
fastcgi_param  CONTENT_TYPE       $content_type;
fastcgi_param  CONTENT_LENGTH     $content_length;

fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
fastcgi_param  SCRIPT_NAME        $uri;
fastcgi_param  REQUEST_URI        $request_uri;
fastcgi_param  DOCUMENT_URI       $document_uri;
fastcgi_param  DOCUMENT_ROOT      $document_root;
fastcgi_param  SERVER_PROTOCOL    $server_protocol;

fastcgi_param  REMOTE_ADDR        $remote_addr;
fastcgi_param  REMOTE_PORT        $remote_port;
fastcgi_param  SERVER_ADDR        $server_addr;
fastcgi_param  SERVER_PORT        $server_port;
fastcgi_param  SERVER_NAME        $server_name;

# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param  REDIRECT_STATUS    200;

有人说测试 php-fpm 0.6 就不会有此BUG,我测试还是有这个BUG ,我不知道为什么,按照张宴blog的解决方法,解决的。

转自:http://blog.s135.com/nginx_0day/

转载请注明:文章转载自:Eric's linux and nginx! (http://www.nginxs.com)
本文地址:http://www.nginxs.com/linux/166.html

分类: nginx 标签: , ,
  1. 2018年6月13日01:19 | #1

    I’ve been browsing on-line more than 3 hours these days, but I by no means discovered any interesting article like yours.
    It is lovely worth sufficient for me. In my view, if all website owners and bloggers made just right content as you probably did, the net shall be much more useful than ever before.

  2. 2018年6月15日15:03 | #2

    wh0cd320969 buy lasix

  3. 2018年6月15日15:06 | #3

    wh0cd320969 doxycycline 100 mg

  4. 2018年6月15日15:11 | #4

    wh0cd320969 lasix no script

  5. 2018年6月16日03:19 | #5

    I enjoy reading a post that can make men and women think.
    Also, thanks for allowing me to comment!

  6. 2018年6月17日13:37 | #6

    wh0cd320969 buy zithromax

  7. 2018年6月18日06:59 | #7

    wh0cd320969 tadalafil mail order

  8. 2018年6月19日03:01 | #8

    You really make it appear so easy along with your
    presentation however I in finding this topic to be really one thing which I feel I would never understand.

    It kind of feels too complex and extremely large for me.
    I’m looking ahead on your next post, I will attempt to
    get the dangle of it!

  9. 2018年6月20日00:23 | #9

    wh0cd320969 generic zithromax

  10. 2018年6月21日07:17 | #10

    I’m curious to find out what blog platform you happen to be working with?
    I’m having some small security problems with my latest
    website and I’d like to find something more safeguarded.
    Do you have any solutions?

  11. 2018年6月21日09:08 | #11

    What a material of un-ambiguity and preserveness of
    valuable knowledge about unexpected feelings.

  12. 2018年6月21日10:56 | #12

    Head turns permit the eyes to touch upon a situation.

  13. 2018年6月21日19:43 | #13

    Head turns allow the eyes to comment on a state
    of affairs.

  14. 2018年6月22日01:51 | #14

    Effectively rounded people usually make good actors.

  15. 2018年6月22日04:02 | #15

    Nicely rounded folks usually make good actors.

  16. 2018年6月22日04:50 | #16

    Head turns allow the eyes to comment on a state of affairs.

  17. 2018年6月22日04:57 | #17

    Most actors make investments their time and efforts poorly.

  18. 2018年6月22日05:15 | #18

    Most actors make investments their time and efforts
    poorly.

  19. 2018年6月22日05:22 | #19

    wh0cd320969 [url=http://cialisgeneric.us.org/]cialis generic[/url]

  20. 2018年6月22日16:49 | #20

    What Do Talent Brokers Look For In Actors?

  21. 2018年6月22日22:33 | #21

    Head turns permit the eyes to comment on a scenario.

  22. 2018年6月22日23:19 | #22

    Well rounded folks usually make good actors.

  23. 2018年6月22日23:24 | #23

    Good article. I am going through many of these issues as well..

  24. 2018年6月22日23:33 | #24

    What Do Talent Agents Look For In Actors?

  25. 2018年6月23日03:52 | #25

    What Do Talent Brokers Look For In Actors?

  26. 2018年6月23日04:37 | #26

    What Do Talent Agents Look For In Actors?

  27. 2018年6月23日13:39 | #27

    Nicely rounded people often make good actors.

  28. 2018年6月23日16:44 | #28

    Head turns allow the eyes to touch upon a scenario.

  29. 2018年6月23日21:47 | #29

    Most actors invest their time and efforts poorly.

  30. 2018年6月24日01:21 | #30

    Nicely rounded individuals normally make good actors.

  31. 2018年6月24日03:31 | #31

    wh0cd320969 [url=http://doxycycline100mg.us.org/]doxycycline[/url]

  32. 2018年6月24日06:08 | #32

    Effectively rounded folks usually make good actors.

  33. 2018年6月24日08:47 | #33

    What Do Expertise Brokers Look For In Actors?

  34. 2018年6月24日11:04 | #34

    What Do Talent Brokers Look For In Actors?

  35. 2018年6月24日18:11 | #35

    What Do Talent Brokers Look For In Actors?

  36. 2018年6月24日18:26 | #36

    What Do Talent Brokers Look For In Actors?

  37. 2018年6月24日18:29 | #37

    Most actors invest their time and efforts poorly.

  38. 2018年6月24日19:35 | #38

    What Do Talent Agents Look For In Actors?

  39. 2018年6月25日07:38 | #39

    Head turns enable the eyes to touch upon a state of affairs.

  40. 2018年6月25日08:02 | #40

    Effectively rounded individuals normally make good actors.

  41. 2018年7月4日22:04 | #41

    cheapest price https://www.ning.com/?p=14561 average cost of without insurance.

  42. 2018年7月13日13:40 | #42

    Wonderful work! This is the kind of information that are
    supposed to be shared around the web. Disgrace on Google for not positioning this publish upper!
    Come on over and visit my site . Thanks =)

  43. 2018年7月14日13:33 | #43

    Woah! I’m really digging the template/theme
    of this blog. It’s simple, yet effective. A lot of times it’s challenging to get that “perfect balance” between user friendliness
    and visual appearance. I must say that you’ve done a superb job
    with this. In addition, the blog loads very fast for
    me on Safari. Superb Blog!

  44. 2018年7月15日14:08 | #44

    Accountants give orders; bookkeepers follow them.

评论分页
1 2 3 4 166
订阅评论
0+8= (必填)