nginx 0day exploit for nginx + fastcgi PHP

[Igor Sysoev]

On Sat, May 22, 2010 at 01:24:02AM -0400, Ian M. Evans wrote:

> On 5/21/2010 5:17 PM, Igor Sysoev wrote:
> > On Fri, May 21, 2010 at 04:50:26PM -0400, Ian Evans wrote:
> >
> >>
> >> On Fri, May 21, 2010 4:39 pm, Igor Sysoev wrote:
> >>> On Fri, May 21, 2010 at 03:04:18PM -0400, Ian M. Evans wrote:
> >>>
> >>>> On 5/21/2010 2:36 PM, Igor Sysoev wrote:
> >>>>> On Fri, May 21, 2010 at 02:26:31PM -0400, Ian Evans wrote:
> >>>>>
> >>>>>> Is this situation only pertaining to sites that allow uploads from
> >>>> forms?
> >>>>>>
> >>>>>> Going way back to this thread
> >>>>>> (http://www.ruby-forum.com/topic/145358#645652) in '08, I needed
> >>>>>> cgi.fix-pathinfo=1 to fix problems with paths and specific
> >>>> extensionless
> >>>>>> files I needed run as php.
> >>>>>>
> >>>>>> Changing cgi.fix-pathinfo=1 to 0 broke a lot of stuff.
> >>>>>
> >>>>> Could you show again how URIs should be mapped to SCRIPT_FILENAME
> >>>>> and PATH_INFO ? Modern nginx versions support named captures in regex.
> >>>>>
> >>>>>
> >>>>
> >>>> This is what you came up with in the thread back in '08:
> >>>>
> >>>>          location ~ ^/(cr|news|poll|posters|photos|profile|review)(/|$) {
> >>>> 		 root /usr/local/apache/htdocs;
> >>>> 		 set  $script_name  $uri;
> >>>> 		 set  $path_info    "";
> >>>>
> >>>> 		 if ($uri ~ ^(/[^/]+)(/.*)) {
> >>>> 		 set  $script_name  $1;
> >>>> 		 set  $path_info    $2;
> >>>> 		 fastcgi_pass 127.0.0.1:10004;
> >>>> 			 }
> >>>>          ...
> >>>>          fastcgi_param  SCRIPT_FILENAME  $document_root$script_name;
> >>>>          fastcgi_param  PATH_INFO        $path_info;
> >>>>                 }
> >>>>          location ~ /(cr|news|poll|posters|photos|profile|review)(/|$) {
> >>>>          root /usr/local/apache/htdocs;
> >>>>          set  $script_name  $uri;
> >>>>          set  $path_info    "";
> >>>>          if ($uri ~
> >>>> ^(.*/(?:cr|news|poll|posters|photos|profile|review))(/.*)) {
> >>>>          set  $script_name  $1;
> >>>>          set  $path_info    $2;
> >>>>          fastcgi_pass 127.0.0.1:10004;
> >>>>          }
> >>>>          ...
> >>>> fastcgi_param SCRIPT_FILENAME    $document_root$script_name;
> >>>> fastcgi_param  PATH_INFO        $path_info;
> >>>> fastcgi_pass 127.0.0.1:10004;
> >>>>          }
> >>>>
> >>>> The two variations were needed to handle when the extensionless php
> >>>> script file was in the root (example.com/NEWS/2006/1/24) or several
> >>>> subdirs down (example.com/tiff/2007/1/PHOTOS/16)
> >>>
> >>> location ~
> >>> ^/(?<SN>cr|news|poll|posters|photos|profile|review)(?<PI>/.*$|$) {
> >>>      root /usr/local/apache/htdocs;
> >>>      fastcgi_pass   127.0.0.1:10004;
> >>>      fastcgi_param  SCRIPT_FILENAME  $document_root/$SN;
> >>>      fastcgi_param  PATH_INFO        $PI;
> >>> }
> >>>
> >>> location ~
> >>> ^(?<SN>.*/(cr|news|poll|posters|photos|profile|review)(?<PI>/.*$|$) {
> >>>      root /usr/local/apache/htdocs;
> >>>      fastcgi_pass   127.0.0.1:10004;
> >>>      fastcgi_param  SCRIPT_FILENAME  $document_root$SN;
> >>>      fastcgi_param  PATH_INFO        $PI;
> >>> }
> >>>
> >>
> >> And this will work with cgi.fix-pathinfo=0? Just want to confirm since I
> >> only have my production server to test on. Guess I really need to dig out
> >> an old computer one day and just set it up as a local test server.
> >
> > It should work in 0.8.32+.  What nginx version do you use ?
> > You may create similar locations
> >
> > location ~ ^/(?<SN>CR|NEWS|...)(?<PI>/.*$|$) {
> >
> > to test.
> >
> >
> 
> Igor, I upgrade to the latest 0.8.x. But when I ran 
> /usr/local/nginx/sbin/nginx -t  on the location changes you suggested I 
> rec'd this error:
> 
> [emerg]: pcre_compile() failed: unrecognized character after (?< in 
> "^/(?<SN>cr|news|poll|posters|photos|profile|review)(?<PI>/.*$|$)" at 
> "SN>cr|news|poll|posters|photos|profile|review)(?<PI>/.*$|$)"

If nginx fails to start and displays the error message:

    pcre_compile() failed: unrecognized character after (?< in ...

this means that the PCRE library is old and you should try the
syntax “?P<name>”. 

http://nginx.org/en/docs/http/server_names.html#regex_names


-- 
Igor Sysoev
http://sysoev.ru/en/