nginx 0day exploit for nginx + fastcgi PHP

[Igor Sysoev]

On Fri, May 21, 2010 at 03:04:18PM -0400, Ian M. Evans wrote:

> On 5/21/2010 2:36 PM, Igor Sysoev wrote:
> > On Fri, May 21, 2010 at 02:26:31PM -0400, Ian Evans wrote:
> >
> >> Is this situation only pertaining to sites that allow uploads from forms?
> >>
> >> Going way back to this thread
> >> (http://www.ruby-forum.com/topic/145358#645652) in '08, I needed
> >> cgi.fix-pathinfo=1 to fix problems with paths and specific extensionless
> >> files I needed run as php.
> >>
> >> Changing cgi.fix-pathinfo=1 to 0 broke a lot of stuff.
> >
> > Could you show again how URIs should be mapped to SCRIPT_FILENAME
> > and PATH_INFO ? Modern nginx versions support named captures in regex.
> >
> >
> 
> This is what you came up with in the thread back in '08:
> 
>         location ~ ^/(cr|news|poll|posters|photos|profile|review)(/|$) {
> 		 root /usr/local/apache/htdocs;
> 		 set  $script_name  $uri;
> 		 set  $path_info    "";
> 			
> 		 if ($uri ~ ^(/[^/]+)(/.*)) {
> 		 set  $script_name  $1;
> 		 set  $path_info    $2;
> 		 fastcgi_pass 127.0.0.1:10004;
> 			 }
>         ...
>         fastcgi_param  SCRIPT_FILENAME  $document_root$script_name;
>         fastcgi_param  PATH_INFO        $path_info;
>                }
>         location ~ /(cr|news|poll|posters|photos|profile|review)(/|$) {
>         root /usr/local/apache/htdocs;
>         set  $script_name  $uri;
>         set  $path_info    "";
>         if ($uri ~ 
> ^(.*/(?:cr|news|poll|posters|photos|profile|review))(/.*)) {
>         set  $script_name  $1;
>         set  $path_info    $2;
>         fastcgi_pass 127.0.0.1:10004;
>         }
>         ...
> fastcgi_param SCRIPT_FILENAME    $document_root$script_name;
> fastcgi_param  PATH_INFO        $path_info;
> fastcgi_pass 127.0.0.1:10004;
>         }
> 
> The two variations were needed to handle when the extensionless php 
> script file was in the root (example.com/NEWS/2006/1/24) or several 
> subdirs down (example.com/tiff/2007/1/PHOTOS/16)

location ~ ^/(?<SN>cr|news|poll|posters|photos|profile|review)(?<PI>/.*$|$) {
    root /usr/local/apache/htdocs;
    fastcgi_pass   127.0.0.1:10004;
    fastcgi_param  SCRIPT_FILENAME  $document_root/$SN;
    fastcgi_param  PATH_INFO        $PI;
}

location ~ ^(?<SN>.*/(cr|news|poll|posters|photos|profile|review)(?<PI>/.*$|$) {
    root /usr/local/apache/htdocs;
    fastcgi_pass   127.0.0.1:10004;
    fastcgi_param  SCRIPT_FILENAME  $document_root$SN;
    fastcgi_param  PATH_INFO        $PI;
}


-- 
Igor Sysoev
http://sysoev.ru/en/