nginx 0day exploit for nginx + fastcgi PHP

Sat May 22 16:44:55 MSD 2010

On 5/22/2010 8:24 AM, Igor Sysoev wrote:
> On Sat, May 22, 2010 at 08:13:58AM -0400, Ian M. Evans wrote:
>
>> On 5/22/2010 6:49 AM, Ian M. Evans wrote:
>>> On 5/22/2010 6:22 AM, Igor Sysoev wrote:
>>>> On Sat, May 22, 2010 at 06:17:26AM -0400, Ian M. Evans wrote:
>>>>> Yep, the two locations you suggested:
>>>>> location ~ ^/(?P<SN>cr...
>>>>> and
>>>>> location ~ ^(?P<SN>.*/(cr...
>>>> I can not reproduce. Do you use 0.8.37 ?
>>>
>>> Yes...I installed it last night and forgot to restart it, so the old
>>> version was still running. Once I finish banging my head on the desk,
>>> I'll disable the cgi.fix_pathinfo and make sure all is well.
>>>
>>> Thanks, and I'll let you know the results.
>>
>> Well, unfortunately, changing cgi.fix_pathinfo to cgi.fix_pathinfo=0
>> killed the extensionless php files, just like it did in 2008.
>>
>> Here's a snippet from the debug log when it works (cgi.fix_pathinfo=1):
>>
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http uri: "/academy/75/photos"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http args: ""
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http exten: ""
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http process request header line
>> ...
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: "/"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
>> "\.(shtml|php|inc)$"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
>> "^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
>> "^/(?P<SN>galleries)(?P<PI>/.*$|$)"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
>> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http regex set $pi to ""
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http regex set $sn to
>> "/academy/75/photos"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 using configuration
>> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
>> ...
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http script var:
>> "/academy/75/photos"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 fastcgi param:
>> "SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http script copy: "PATH_INFO"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http script var: ""
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 fastcgi param: "PATH_INFO: "
>> ...
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http finalize request: -4,
>> "/academy/75/photos?" a:1, c:2
>> ...
>> 2010/05/22 07:50:52 [debug] 24492#0: *1153 http fastcgi record length: 8184
>>
>> And here's the same request failing when cgi.fix_pathinfo is turned off:
>>
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http uri: "/academy/75/photos"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http args: ""
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http exten: ""
>> ...
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
>> "\.(shtml|php|inc)$"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
>> "^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
>> "^/(?P<SN>galleries)(?P<PI>/.*$|$)"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
>> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http regex set $pi to ""
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http regex set $sn to
>> "/academy/75/photos"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 using configuration
>> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
>> ...
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http script var:
>> "/academy/75/photos"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 fastcgi param:
>> "SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http script copy: "PATH_INFO"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http script var: ""
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 fastcgi param: "PATH_INFO: "
>> ...
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http finalize request: -4,
>> "/academy/75/photos?" a:1, c:2
>> ...
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http upstream request:
>> "/academy/75/photos?"
>> ...
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http finalize request: 404,
>> "/academy/75/photos?" a:1, c:1
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http special response: 404,
>> "/academy/75/photos?"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 internal redirect:
>> "/dhe404.shtml?"
>>
>> Thanks for any suggestions. What I find interesting (mind-boggling?) is
>> that in both instances $pi, $sn, SCRIPT_FILENAME and PATH_INFO are the
>> same yet one succeeds and the other tosses a 404.
>
> If you request "/academy/75/photos/" with with cgi.fix_pathinfo=0,
> does it work ?
>
>

Adding the trailing slash still produced a 404.

2010/05/22 08:35:22 [debug] 24492#0: *1744 http uri: "/academy/75/photos/"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http args: ""
2010/05/22 08:35:22 [debug] 24492#0: *1744 http exten: ""
2010/05/22 08:35:22 [debug] 24492#0: *1744 http process request header line
2010/05/22 08:35:22 [debug] 24492#0: *1744 test location: ~ 
"\.(shtml|php|inc)$"
2010/05/22 08:35:22 [debug] 24492#0: *1744 test location: ~ 
"^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
2010/05/22 08:35:22 [debug] 24492#0: *1744 test location: ~ 
"^/(?P<SN>galleries)(?P<PI>/.*$|$)"
2010/05/22 08:35:22 [debug] 24492#0: *1744 test location: ~ 
"^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http regex set $pi to "/"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http regex set $sn to 
"/academy/75/photos"
2010/05/22 08:35:22 [debug] 24492#0: *1744 using configuration 
"^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http script copy: 
"SCRIPT_FILENAME"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http script var: 
"/usr/local/apache/htdocs"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http script var: 
"/academy/75/photos"
2010/05/22 08:35:22 [debug] 24492#0: *1744 fastcgi param: 
"SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http script copy: "PATH_INFO"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http script var: "/"
2010/05/22 08:35:22 [debug] 24492#0: *1744 fastcgi param: "PATH_INFO: /"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http finalize request: -4, 
"/academy/75/photos/?" a:1, c:2
2010/05/22 08:35:22 [debug] 24492#0: *1744 http upstream request: 
"/academy/75/photos/?"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi header: "Status: 
404 Not Found"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi parser: 0
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi header: 
"X-Powered-By: PHP/5.2.5"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi parser: 0
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi header: 
"Content-type: text/html"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi parser: 1
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi header done
2010/05/22 08:35:22 [debug] 24492#0: *1744 finalize http upstream 
request: 404
2010/05/22 08:35:22 [debug] 24492#0: *1744 finalize http fastcgi request
2010/05/22 08:35:22 [debug] 24492#0: *1744 free rr peer 1 0
2010/05/22 08:35:22 [debug] 24492#0: *1744 close http upstream 
connection: 13
2010/05/22 08:35:22 [debug] 24492#0: *1744 event timer del: 13: 3221463051
2010/05/22 08:35:22 [debug] 24492#0: *1744 rtsig del connection: fd:13
2010/05/22 08:35:22 [debug] 24492#0: *1744 http finalize request: 404, 
"/academy/75/photos/?" a:1, c:1
2010/05/22 08:35:22 [debug] 24492#0: *1744 http special response: 404, 
"/academy/75/photos/?"
2010/05/22 08:35:22 [debug] 24492#0: *1744 internal redirect: 
"/dhe404.shtml?"