5 ms·
Avoiding Arbitrary Code Execution with nginx and php-fastcgi
- kitcar 16y agoWas totally unaware of this issue in Nginx/PHP-FPM - going to check my conf files now! UPDATE: Here's the thread on this issue right from NGINX.org http://forum.nginx.org/read.php?2,88845,page=3 http://forum.nginx.org/read.php?2,88845,page=3
- nbpoole 16y agoYup, that was the first page I found too: it's also the first result for "php nginx 0 day." I link to it a couple times in the post. :)
- pilif 16y agoThis is another reason why it was a good idea to have my big application consist of only one public file which can easily be whitelisted. Everything else lives outside the web root and is never directly executed. location ~ ^/index\.php { proxy_pass http://localhost:8080; } Everything else in the web root is static files and can be served directly. The rest of the application uses an URL routing scheme based on PATH_INFO
- ichilton 16y agoI use something similar but a bit simpler to read: location = /index.php { fastcgi_pass 127.0.0.1:9000; }
- CWIZO 16y agoIs this PHP-FastCGI specific, or is PHP-FPM affected too?
- jacques_chester 16y agoPHP-FPM is FastCGI, with a process manager thrown in.
- CWIZO 16y agoOh, I'm not a sys admin, so I wasn't sure :) Thanks.
- acabal 16y agoWow, am I glad I caught this link--I'm just now switching my servers from Apache to Nginx/php-fastcgi, configured more or less just like the article says... I decided to switch to Nginx for the fabled performance benefits and relatively simple configuration. But this now makes me wonder what other gotchas there are in store for me... I have a long history with Apache, maybe I should just stick with it after all...
- d_r 16y agoArticles like this is exactly why I come to HN. I was planning to move my server from Apache to Nginx soon. I suppose it's as a good time as ever to learn any gotchas.
- dhimes 16y agoLikewise. I just set up a staging server based on the Linode tutorials. In another month I would have been hosed.
- Joakal 16y agoFor strong security (especially for frameworks like CodeIgniter): location = /index.php { proxy_pass http://localhost:8080 http://localhost:8080; } It only runs exactly index.php in the root.
- calloc 16y agoDoes this same issue exist within Lighttpd with a FastCGI setup?
- tszming 16y agoIn fact, this is well documented: http://wiki.nginx.org/Pitfalls#Passing_Every_.7E_.5C.php.24_request_to_to_PHP http://wiki.nginx.org/Pitfalls#Passing_Every_.7E_.5C.php.24_...