5 ms·

nginx' configuration format leaves a lot to be desired, as evidenced by the (former, hopefully) widespread use of exploitable php calls. There are also if dire

by xorcist 12y ago

nginx' configuration format leaves a lot to be desired, as evidenced by the (former, hopefully) widespread use of exploitable php calls. There are also if directives in there, but they don't really work they way you think. You really need a deep understanding of its parsing rules in order to do anything remotely complicated with it. It's certainly possible to do better. (Please don't mention Apache here and its steaming pile of faux-xml. Existence of worse does not make better.)

lonnyk 12y ago
> as evidenced by the (former, hopefully) widespread use of exploitable php calls Could someone elaborate on what this is referring to?
- meowface 12y ago
  Read through https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/ https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-an...
  - makomk 12y ago
    That's not really nginx's fault, its behaviour is quite sensible. The main problem is that PHP does some poorly-documented magic behind the scenes[1] that modifies the information nginx gives it in a way that causes security issues. The solution is not to do that; if you really need the path-splitting functionality that cgi.fix_pathinfo provides, it's better and safer to set fastcgi_split_path_info in the nginx configuration instead. [1] http://php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfo http://php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfo - the docs on cgi.fix_pathinfo don't mention that it affects which PHP file gets executed at all.
meowface 12y ago
>nginx' configuration format leaves a lot to be desired, as evidenced by the (former, hopefully) widespread use of exploitable php calls. This has nothing to do with nginx's config format at all. It's simply a vulnerability in FastCGI for PHP and the way PHP file paths are passed.
- xorcist 12y ago
  It's a well documented feature that has existed since always. The vulnerability arises because the obvious way to configure this handler in nginx is to write regexps. You could just as well have handed the user a loaded gun pointed at their foot.
lumpypua 12y ago
Like a lot of configurations formats the semantics of nginx's config files has pitfalls: http://wiki.nginx.org/IfIsEvil http://wiki.nginx.org/IfIsEvil Not a fan of nginx's config but I'm a huge fan of nginx.

by xorcist 12y ago

lonnyk 12y ago

> as evidenced by the (former, hopefully) widespread use of exploitable php calls Could someone elaborate on what this is referring to?

meowface 12y ago
Read through https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/ https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-an...
- makomk 12y ago
  That's not really nginx's fault, its behaviour is quite sensible. The main problem is that PHP does some poorly-documented magic behind the scenes[1] that modifies the information nginx gives it in a way that causes security issues. The solution is not to do that; if you really need the path-splitting functionality that cgi.fix_pathinfo provides, it's better and safer to set fastcgi_split_path_info in the nginx configuration instead. [1] http://php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfo http://php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfo - the docs on cgi.fix_pathinfo don't mention that it affects which PHP file gets executed at all.

meowface 12y ago

>nginx' configuration format leaves a lot to be desired, as evidenced by the (former, hopefully) widespread use of exploitable php calls. This has nothing to do with nginx's config format at all. It's simply a vulnerability in FastCGI for PHP and the way PHP file paths are passed.

xorcist 12y ago
It's a well documented feature that has existed since always. The vulnerability arises because the obvious way to configure this handler in nginx is to write regexps. You could just as well have handed the user a loaded gun pointed at their foot.

lumpypua 12y ago

Like a lot of configurations formats the semantics of nginx's config files has pitfalls: http://wiki.nginx.org/IfIsEvil http://wiki.nginx.org/IfIsEvil Not a fan of nginx's config but I'm a huge fan of nginx.