首页 > nginx > 转发:Nginx文件类型错误解析漏洞

转发:Nginx文件类型错误解析漏洞

2010年5月24日 eric 发表评论 阅读评论

其实此漏洞并不是Nginx的漏洞,而是PHP PATH_INFO的漏洞,详见:http://bugs.php.net/bug.php?id=50852&edit=1
例如用户上传了一张照片,访问地址为http://www.domain.com/images/test.jpg,而test.jpg文件内的内容实际上是PHP代码时,通过http://www.domain.com/images/test.jpg/abc.php就能够执行该文件内的PHP代码。

网上提供的临时解决方法有:
  方法①、修改php.ini,设置cgi.fix_pathinfo = 0;然后重启php-cgi。此修改会影响到使用PATH_INFO伪静态的应用,例如我以前博文的URL:http://blog.s135.com/read.php/348.htm 就不能访问了。

  方法②、在nginx的配置文件添加如下内容后重启:if ( $fastcgi_script_name ~ \..*\/.*php ) {return 403;}。该匹配会影响类似 http://www.domain.com/software/5.0/test.php(5.0为目录),http://www.domain.com/goto.php/phpwind 的URL访问。

  方法③、对于存储图片的location{…},或虚拟主机server{…},只允许纯静态访问,不配置PHP访问。例如在金山逍遥网论坛、SNS上传的图片、附件,会传送到专门的图片、附件存储服务器集群上(pic.xoyo.com),这组服务器提供纯静态服务,无任何动态PHP配置。各大网站几乎全部进行了图片服务器分离,因此Nginx的此次漏洞对大型网站影响不大。

本人再提供一种修改nginx.conf配置文件的临时解决方法,兼容“http://blog.s135.com/demo/0day/phpinfo.php/test”的PATH_INFO伪静态,拒绝“http://blog.s135.com/demo/0day/phpinfo.jpg/test.php”的漏洞攻击:

location ~* .*\.php($|/)
{
      if ($request_filename ~* (.*)\.php) {
            set $php_url $1;
      }
      if (!-e $php_url.php) {
            return 403;
      }

      fastcgi_pass  127.0.0.1:9000;
      fastcgi_index index.php;
      include fcgi.conf;
}

  也可将以下内容写在fcgi.conf文件中,便于多个虚拟主机引用:

if ($request_filename ~* (.*)\.php) {
    set $php_url $1;
}
if (!-e $php_url.php) {
    return 403;
}

fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
fastcgi_param  SERVER_SOFTWARE    nginx;

fastcgi_param  QUERY_STRING       $query_string;
fastcgi_param  REQUEST_METHOD     $request_method;
fastcgi_param  CONTENT_TYPE       $content_type;
fastcgi_param  CONTENT_LENGTH     $content_length;

fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
fastcgi_param  SCRIPT_NAME        $uri;
fastcgi_param  REQUEST_URI        $request_uri;
fastcgi_param  DOCUMENT_URI       $document_uri;
fastcgi_param  DOCUMENT_ROOT      $document_root;
fastcgi_param  SERVER_PROTOCOL    $server_protocol;

fastcgi_param  REMOTE_ADDR        $remote_addr;
fastcgi_param  REMOTE_PORT        $remote_port;
fastcgi_param  SERVER_ADDR        $server_addr;
fastcgi_param  SERVER_PORT        $server_port;
fastcgi_param  SERVER_NAME        $server_name;

# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param  REDIRECT_STATUS    200;

有人说测试 php-fpm 0.6 就不会有此BUG,我测试还是有这个BUG ,我不知道为什么,按照张宴blog的解决方法,解决的。

转自:http://blog.s135.com/nginx_0day/

转载请注明:文章转载自:Eric's linux and nginx! (http://www.nginxs.com)
本文地址:http://www.nginxs.com/linux/166.html

分类: nginx 标签: , ,
  1. 2018年4月4日15:27 | #1

    Liked the service: Lawn Love was nice!

  2. 2018年4月5日00:42 | #2

    Good merchandise – useful and knowledgeable service.

  3. 2018年4月6日02:08 | #3

    Thanks for any other fantastic article. The place else could anybody get that
    type of info in such an ideal means of writing? I’ve a presentation subsequent week,
    and I’m at the look for such info.

  4. 2018年4月6日06:58 | #4

    The Roofing Company of Tampa Bay Inc. • Roof flashings.

  5. 2018年4月6日18:20 | #5

    Glorioso Tree Service is a UNBELIEVABLE firm.

  6. 2018年4月7日13:58 | #6

    Select between listings and articles on Yahoo Autos.

  7. 2018年4月8日03:35 | #7

    Choose the right trim on your HardwoodInstallation.

  8. 2018年4月8日14:47 | #8

    Cleaning out your gutters isn’t precisely a easy job.

  9. 2018年4月8日23:04 | #9

    Load the sander with 30-40 grit sandpaper.

  10. 2018年4月8日23:14 | #10

    Wonderful blog! I found it while surfing around on Yahoo News.
    Do you have any suggestions on how to get listed in Yahoo News?
    I’ve been trying for a while but I never seem to get there!
    Appreciate it

  11. 2018年4月9日01:06 | #11

    Thanks for every other wonderful article. Where else could
    anybody get that type of info in such an ideal approach of writing?
    I have a presentation next week, and I am at the search for such
    information.

  12. 2018年4月9日02:11 | #12

    Jeny is a known professional on black mould remove.

  13. 2018年4月9日04:15 | #13

    You have made some really good points there. I looked on the internet to learn more about
    the issue and found most individuals will go along with your views on this site.

  14. 2018年4月9日04:43 | #14

    I got this website from my friend who informed
    me concerning this web site and at the moment this time I am visiting this website and reading
    very informative content at this place.

  15. 2018年4月9日05:41 | #15

    For the reason that the admin of this site is working, no question very quickly it will be famous, due to its feature contents.

  16. 2018年4月9日22:59 | #16

    Owners often want a tree service for three reasons.

  17. 2018年4月10日09:36 | #17

    sales online australia http://drugstore-usa.science/ generic health tablets.

  18. 2018年4月11日17:32 | #18

    Tow Truck & Wrecker Towing Service Northline TX.

  19. 2018年4月11日17:53 | #19

    This post is invaluable. Where can I find out
    more?

  20. 2018年4月12日12:14 | #20

    Since the admin of this website is working, no question very shortly it will be well-known, due to its feature contents.

  21. 2018年4月12日16:13 | #21

    Thanks for finally talking about >Eric’s linux and nginx!
    > 转发:Nginx文件类型错误解析漏洞 <Loved it!

  22. 2018年4月12日16:45 | #22

    continuously i used to read smaller articles or reviews that also clear their motive, and that is
    also happening with this post which I am reading here.

  23. 2018年4月12日23:41 | #23

    buy generic online canada http://online-medications.men/ Buying pills new zealand.

  24. 2018年4月14日11:04 | #24

    Not all mould that appears black or dark is toxic.

  25. 2018年4月14日15:09 | #25

    Mildew spores is not going to survive in dry climates.

  26. 2018年4月15日12:03 | #26

    Sacramento county jail visiting hours, http://background-check-services-for-employers.science fayette county public records ky.

  27. 2018年4月16日04:12 | #27

    We are the third technology of roofing contractors.

  28. 2018年4月16日10:26 | #28

    They are also known as moveable steam cleaner.

  29. 2018年4月16日22:21 | #29

    We’re the third technology of roofing contractors.

  30. 2018年4月17日13:49 | #30

    There are different types of HVAC programs.

  31. 2018年4月19日14:22 | #31

    We did not discover results for: hardwood flooring.

订阅评论
2+8= (必填)