2 ms·

That has been a known issue in nginx for a very long time and its a common attack vector at CTFs: https://book.hacktricks.xyz/network-services-pentesting/pente

• magicalhippo 3y ago
  There is a LFI vulnerability because: /imgs../flag.txt Transforms to: /path/images/../flag.txt I've only implemented a handful of HTTP servers for fun, but I've always resolved relative paths and constrained them. So I'd turn "/path/images/../flag.txt" into "/path/flag.txt", which would not start with the root "/path/images/" and hence denied without further checks. Am I wrong, or, why doesn't nginx do this?
  • hanikesn 3y ago
    It does when you use the root directive. Alias should hardly be used if possible for those reasons.
• deleted 3y ago
  [deleted]