4 ms·
This is a very interesting attack vector. There are many situations where less privileged users can inject stuff into an nginx config.
by discordianfish 10y ago
This is a very interesting attack vector. There are many situations where less privileged users can inject stuff into an nginx config.
- TarqDirtyToMe 10y agoI'd be interested to see if any web-based control panels are vulnerable in a similar way. All of the client_*_temp_path directives are valid in http,server, and location contexts so you have a lot of flexibility there.