nginx 0day exploit for nginx + fastcgi PHP

[Ian M. Evans]

On 5/22/2010 6:49 AM, Ian M. Evans wrote:
> On 5/22/2010 6:22 AM, Igor Sysoev wrote:
>> On Sat, May 22, 2010 at 06:17:26AM -0400, Ian M. Evans wrote:
>>> Yep, the two locations you suggested:
>>> location ~ ^/(?P<SN>cr...
>>> and
>>> location ~ ^(?P<SN>.*/(cr...
>> I can not reproduce. Do you use 0.8.37 ?
>
> Yes...I installed it last night and forgot to restart it, so the old
> version was still running. Once I finish banging my head on the desk,
> I'll disable the cgi.fix_pathinfo and make sure all is well.
>
> Thanks, and I'll let you know the results.

Well, unfortunately, changing cgi.fix_pathinfo to cgi.fix_pathinfo=0 
killed the extensionless php files, just like it did in 2008.

Here's a snippet from the debug log when it works (cgi.fix_pathinfo=1):

2010/05/22 07:50:51 [debug] 24492#0: *1153 http uri: "/academy/75/photos"
2010/05/22 07:50:51 [debug] 24492#0: *1153 http args: ""
2010/05/22 07:50:51 [debug] 24492#0: *1153 http exten: ""
2010/05/22 07:50:51 [debug] 24492#0: *1153 http process request header line
...
2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: "/"
2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~ 
"\.(shtml|php|inc)$"
2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~ 
"^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~ 
"^/(?P<SN>galleries)(?P<PI>/.*$|$)"
2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~ 
"^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
2010/05/22 07:50:51 [debug] 24492#0: *1153 http regex set $pi to ""
2010/05/22 07:50:51 [debug] 24492#0: *1153 http regex set $sn to 
"/academy/75/photos"
2010/05/22 07:50:51 [debug] 24492#0: *1153 using configuration 
"^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
...
2010/05/22 07:50:51 [debug] 24492#0: *1153 http script var: 
"/academy/75/photos"
2010/05/22 07:50:51 [debug] 24492#0: *1153 fastcgi param: 
"SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
2010/05/22 07:50:51 [debug] 24492#0: *1153 http script copy: "PATH_INFO"
2010/05/22 07:50:51 [debug] 24492#0: *1153 http script var: ""
2010/05/22 07:50:51 [debug] 24492#0: *1153 fastcgi param: "PATH_INFO: "
...
2010/05/22 07:50:51 [debug] 24492#0: *1153 http finalize request: -4, 
"/academy/75/photos?" a:1, c:2
...
2010/05/22 07:50:52 [debug] 24492#0: *1153 http fastcgi record length: 8184

And here's the same request failing when cgi.fix_pathinfo is turned off:

2010/05/22 07:53:18 [debug] 24492#0: *1196 http uri: "/academy/75/photos"
2010/05/22 07:53:18 [debug] 24492#0: *1196 http args: ""
2010/05/22 07:53:18 [debug] 24492#0: *1196 http exten: ""
...
2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~ 
"\.(shtml|php|inc)$"
2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~ 
"^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~ 
"^/(?P<SN>galleries)(?P<PI>/.*$|$)"
2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~ 
"^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
2010/05/22 07:53:18 [debug] 24492#0: *1196 http regex set $pi to ""
2010/05/22 07:53:18 [debug] 24492#0: *1196 http regex set $sn to 
"/academy/75/photos"
2010/05/22 07:53:18 [debug] 24492#0: *1196 using configuration 
"^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
...
2010/05/22 07:53:18 [debug] 24492#0: *1196 http script var: 
"/academy/75/photos"
2010/05/22 07:53:18 [debug] 24492#0: *1196 fastcgi param: 
"SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
2010/05/22 07:53:18 [debug] 24492#0: *1196 http script copy: "PATH_INFO"
2010/05/22 07:53:18 [debug] 24492#0: *1196 http script var: ""
2010/05/22 07:53:18 [debug] 24492#0: *1196 fastcgi param: "PATH_INFO: "
...
2010/05/22 07:53:18 [debug] 24492#0: *1196 http finalize request: -4, 
"/academy/75/photos?" a:1, c:2
...
2010/05/22 07:53:18 [debug] 24492#0: *1196 http upstream request: 
"/academy/75/photos?"
...
2010/05/22 07:53:18 [debug] 24492#0: *1196 http finalize request: 404, 
"/academy/75/photos?" a:1, c:1
2010/05/22 07:53:18 [debug] 24492#0: *1196 http special response: 404, 
"/academy/75/photos?"
2010/05/22 07:53:18 [debug] 24492#0: *1196 internal redirect: 
"/dhe404.shtml?"

Thanks for any suggestions. What I find interesting (mind-boggling?) is 
that in both instances $pi, $sn, SCRIPT_FILENAME and PATH_INFO are the 
same yet one succeeds and the other tosses a 404.