nginx 0day exploit for nginx + fastcgi PHP

[Igor Sysoev]

On Sat, May 22, 2010 at 08:13:58AM -0400, Ian M. Evans wrote:

> On 5/22/2010 6:49 AM, Ian M. Evans wrote:
> > On 5/22/2010 6:22 AM, Igor Sysoev wrote:
> >> On Sat, May 22, 2010 at 06:17:26AM -0400, Ian M. Evans wrote:
> >>> Yep, the two locations you suggested:
> >>> location ~ ^/(?P<SN>cr...
> >>> and
> >>> location ~ ^(?P<SN>.*/(cr...
> >> I can not reproduce. Do you use 0.8.37 ?
> >
> > Yes...I installed it last night and forgot to restart it, so the old
> > version was still running. Once I finish banging my head on the desk,
> > I'll disable the cgi.fix_pathinfo and make sure all is well.
> >
> > Thanks, and I'll let you know the results.
> 
> Well, unfortunately, changing cgi.fix_pathinfo to cgi.fix_pathinfo=0 
> killed the extensionless php files, just like it did in 2008.
> 
> Here's a snippet from the debug log when it works (cgi.fix_pathinfo=1):
> 
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http uri: "/academy/75/photos"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http args: ""
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http exten: ""
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http process request header line
> ...
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: "/"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~ 
> "\.(shtml|php|inc)$"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~ 
> "^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~ 
> "^/(?P<SN>galleries)(?P<PI>/.*$|$)"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~ 
> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http regex set $pi to ""
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http regex set $sn to 
> "/academy/75/photos"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 using configuration 
> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
> ...
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http script var: 
> "/academy/75/photos"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 fastcgi param: 
> "SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http script copy: "PATH_INFO"
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http script var: ""
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 fastcgi param: "PATH_INFO: "
> ...
> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http finalize request: -4, 
> "/academy/75/photos?" a:1, c:2
> ...
> 2010/05/22 07:50:52 [debug] 24492#0: *1153 http fastcgi record length: 8184
> 
> And here's the same request failing when cgi.fix_pathinfo is turned off:
> 
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http uri: "/academy/75/photos"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http args: ""
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http exten: ""
> ...
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~ 
> "\.(shtml|php|inc)$"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~ 
> "^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~ 
> "^/(?P<SN>galleries)(?P<PI>/.*$|$)"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~ 
> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http regex set $pi to ""
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http regex set $sn to 
> "/academy/75/photos"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 using configuration 
> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
> ...
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http script var: 
> "/academy/75/photos"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 fastcgi param: 
> "SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http script copy: "PATH_INFO"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http script var: ""
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 fastcgi param: "PATH_INFO: "
> ...
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http finalize request: -4, 
> "/academy/75/photos?" a:1, c:2
> ...
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http upstream request: 
> "/academy/75/photos?"
> ...
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http finalize request: 404, 
> "/academy/75/photos?" a:1, c:1
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http special response: 404, 
> "/academy/75/photos?"
> 2010/05/22 07:53:18 [debug] 24492#0: *1196 internal redirect: 
> "/dhe404.shtml?"
> 
> Thanks for any suggestions. What I find interesting (mind-boggling?) is 
> that in both instances $pi, $sn, SCRIPT_FILENAME and PATH_INFO are the 
> same yet one succeeds and the other tosses a 404.

If you request "/academy/75/photos/" with with cgi.fix_pathinfo=0,
does it work ?


-- 
Igor Sysoev
http://sysoev.ru/en/