Nginx+PHP 配置漏洞:静态文件都可以当作 PHP 解析

漏洞危险等级:毁灭性。

这个漏洞严格上说并不是 Nginx 和 PHP 本身的漏洞造成的,而是由配置造成的。在我之前写的许多配置中,都普遍存在这个漏洞。

简易检测方法:
打开 Nginx + PHP 服务器上的任意一张图片,如:
http://hily.me/test.png
如果在图片链接后加一串 /xxx.php (xxx为任意字符)后,如:
http://hily.me/test.png/xxx.php
图片还能访问的话,说明你的配置存在漏洞。

漏洞分析:

下面通过分析一个很常见的 Nginx 配置来解释下漏洞的成因:

server {
    listen       80;
    server_name  test.local;

    access_log  /work/www/logs/test.access.log  main;
    error_log  /work/www/logs/test.error.log;

    location / {
        root   /work/www/test;
        index  index.html index.htm index.php;
    }

    location ~ \.php$ {
        root           /work/www/test;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
        include        fastcgi_params;
        fastcgi_pass   unix:/tmp/php-fpm.sock;
    }
}

我们在 /work/www/test/ 目录下新建一个文件 test.png,内容如下:

那么访问 http://test.local/test.png 时,输出为文本内容:

但是当在后面加上 /xxx.php 时,即 http://test.local/test.png/xxx.php,可怕的事情发生了:

Array
(
    [HOSTNAME] => 
    [PATH] => /usr/local/bin:/usr/bin:/bin
    [TMP] => /tmp
    [TMPDIR] => /tmp
    [TEMP] => /tmp
    [OSTYPE] => 
    [MACHTYPE] => 
    [MALLOC_CHECK_] => 2
    [USER] => www
    [HOME] => /home/www
    [FCGI_ROLE] => RESPONDER
    [SCRIPT_FILENAME] => /work/www/test/test.png
    [QUERY_STRING] => 
    [REQUEST_METHOD] => GET
    [CONTENT_TYPE] => 
    [CONTENT_LENGTH] => 
    [SCRIPT_NAME] => /test.png/xxx.php
    [REQUEST_URI] => /test.png/xxx.php
    [DOCUMENT_URI] => /test.png/xxx.php
    [DOCUMENT_ROOT] => /work/www/test
    [SERVER_PROTOCOL] => HTTP/1.1
    [GATEWAY_INTERFACE] => CGI/1.1
    [SERVER_SOFTWARE] => nginx/0.7.62
    [REMOTE_ADDR] => 192.168.1.163
    [REMOTE_PORT] => 4080
    [SERVER_ADDR] => 192.168.1.12
    [SERVER_PORT] => 80
    [SERVER_NAME] => test.local
    [REDIRECT_STATUS] => 200
    [HTTP_ACCEPT] => image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/QVOD, application/QVOD, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
    [HTTP_ACCEPT_LANGUAGE] => zh-cn
    [HTTP_ACCEPT_ENCODING] => gzip, deflate
    [HTTP_USER_AGENT] => Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; QQPinyin 689; QQDownload 627; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2; TheWorld)
    [HTTP_HOST] => test.local
    [HTTP_CONNECTION] => Keep-Alive
    [ORIG_SCRIPT_FILENAME] => /work/www/test/test.png/xxx.php
    [PATH_TRANSLATED] => /work/www/test
    [PHP_SELF] => /test.png/xxx.php
    [REQUEST_TIME] => 1274125615
)

环境变量中,SCRIPT_FILENAME 是 Nginx 传过来的:

fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;

$fastcgi_script_name 变量说明请参考:
http://wiki.nginx.org/NginxHttpFcgiModule

Nginx 传给 PHP 的值为 /work/www/test/test.png/xxx.php,即 $_SERVER 中 ORIG_SCRIPT_FILENAME 的值,但是 $_SERVER 中 SCRIPT_FILENAME 却是 /work/www/test/test.png。

原因是,/work/www/test/test.png/xxx.php 并不存在,对于这些不存在的路径,PHP 会检查路径中存在的文件,并将多余的部分当作 PATH_INFO。
这里,/work/www/test/test.png 被 PHP 解析为 SCRIPT_FILENAME,/xxx.php 被 PHP 解析为 PATH_INFO 后被丢弃,因此并没有在 $_SERVER 中出现。

解决方法:

解决这个漏洞的方法很显然:关闭上面所述的解析即可。

这个解析可以在 PHP 的配置文件中设置,默认为开启。在这里我们需要将它关闭:

; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP’s
; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting
; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting
; of zero causes PHP to behave as before. Default is 1. You should fix your scripts
; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
; http://php.net/cgi.fix-pathinfo
;cgi.fix_pathinfo=1
cgi.fix_pathinfo=0

其中 cgi.fix_pathinfo=0 为新增的配置行,表示关闭 PHP 的自动 PATH_INFO 检测。关闭后,该配置漏洞即可消除。

更好的解决方案?
以上方案并不是最完美的,如果你先前有用到 cgi.fix_pathinfo 这个特性,影响会很大,比如关闭后,我的 Blog(Wordpress)文章的 URL 目录形式就得用 rewrite 来实现了。
如果可以将 PHP 设置成只解析 .php 为扩展名的文件,那么这个问题解决起来会更合理。
不过我没找到相关的设置项,或许今后应该出现在 php-fpm 的配置文件中?

总结:
这类问题基本上是无法预料的,但是如果架构设计良好的话,即使存在这个问题,也不会影响安全性。这里给出架构上的安全建议:
* 尽可能使动静内容分离,所有的静态内容存在于静态内容服务器,静态内容服务器上不解析PHP,这样静态文件就永远不能被解析了。

— EOF —

《Nginx+PHP 配置漏洞:静态文件都可以当作 PHP 解析》有71个想法

    1. Visit the portal, if carnegie endowment 990 you could help me by filling out a survey, I’d really appreciate that.
      Now who has title to the equipment, you know, even after the funding ends.

      And then I’ll sennd out the actual Powerpoint file,
      um, if you havce a better sense for why and how I have made decisions that have affected the individual lives of our citizens.
      Neww York State resident in order to help them in their country.
      Now this is a good supplement to help yyou with youhr education.

  1. I like what you guys tend to be up too. This type of clever work and
    coverage! Keep up the awesome works guys I’ve included you
    guys to our blogroll.

  2. We are a group a group of volunteers and opening
    a brand new scheme in our community. Your website offered us with valuable
    and work on . You have a formidable process and our all the community
    will thankful to you .
    Undeniably believe that you said .

    Your favorite reason appeared to be at the internet easy
    factor to account of . I tell you , i certainly annoyed people think
    issues clear that not recognize about . You controlled
    and defined everything managed to hit the nail on the top no need
    side effect , people could take a signal.
    Will likely be back to get more. Thank you

    Here is my web site: Dragon Story Cheats

  3. The rear brake caliper is a single-piston caliper, and my test
    cars jojo car was the fact that they are supportive for burning less fossil fuel.

    The reason for such a powerful vehicle. 6 liter V6 Luxury AWD variant of Suzuki SX4
    Crossover turns out to be disastrous in case of accidents.
    It has a top speed of 86 miles per hour but it’s a small price tag.
    Most individuals experience the thrill and excitement of formula
    1 racing is referred to as PIP, is usually a good way to go.

  4. If Congress does nothing, the tax bite is a significant factor undermining consumers’ confidence about spending.
    They’re joined by eBay, an association of small Internet accounting office technology sellers
    called WE R HERE, and NetChoice, which includes Argentina, Venezuela, Paraguay and Uruguay.
    However, Mr Malema and other ANC leaders had objected, arguing that
    allowing them to pay out-of-pocket expenses with pretax money.
    Corporate accounting office technology tax in the country.

  5. When I originally commented I appear to have clicked on the -Notify me when new comments
    are added- checkbox and from now on every time
    a comment is added I recieve 4 emails with the exact same comment.
    There has to be a means you are able to remove me from that service?
    Appreciate it!

    Feel free to surf to my weblog … real estate investing

  6. Unquestionably consider that which you stated.
    Your favourite justification appeared to be at the web the simplest thing to be aware of.
    I say to you, I certainly get annoyed even as people think
    about issues that they plainly don’t recognize about.
    You managed to hit the nail upon the highest and
    also defined out the whole thing with no need side-effects , other
    folks can take a signal. Will likely be again to get more.
    Thanks

  7. I’m a programmer and I’ve just developed a unique online social network web-site.
    I’m just in the market for ‘beta’ evaluators to surf and give
    it a go. Do you need to subscribe? We are going to compensate you.

  8. Hello there I am so grateful I found your web site,
    I really found you by mistake, while I was researching on Bing for
    something else, Regardless I am here now and would just like to say thanks
    a lot for a marvelous post and a all round interesting
    blog (I also love the theme/design), I don’t have time to read through it all
    at the minute but I have bookmarked it and also added your RSS feeds, so when I have time I will be back to read a lot more, Please do keep
    up the awesome b.

  9. Fast-working, their effect lasts only a short time. If the patient has
    sufficient strength panchakarma treatment can be started with snehana followed
    by vamana and virechana. At the conclusion of the event, the vast array of bandanas will create
    a strong visual representation of the devastation of diabetes in America.

    My web-site … restore my blood sugar

  10. Hello! This is my first comment here so I just wanted to give a quick shout out and
    tell you I genuinely enjoy reading your posts. Can you recommend any
    other blogs/websites/forums that go over the same subjects?
    Appreciate it!

  11. Fine way of explaining, and nice piece of writing to get facts regarding my presentation subject matter, which i am
    going to deliver in institution of higher education.

  12. Hello, i feel that i saw you visited my web site thus i got here to go back the choose?.I am
    attempting to to find issues to enhance my web site!I suppose
    its ok to make use of some of your ideas!!

  13. I just like the helpful info you supply on your articles.

    I’ll bookmark your blog and check once more right here
    regularly. I am moderately sure I’ll be informed lots of new stuff right here!
    Best of luck for the following!

    Feel free to surf to my website; How To Cure Herpes

  14. Of course, if you want to build teamwork, you will definitely want to practice together.
    So strap on all your paintball load and gear up those paintball guns,
    Tanisha,!
    If” scenarios, and more, work on defensive and offensive strategies, code words, “what-.

    Gain knowledge from the opposition as well as your personal teammates.
    Tightly notice other paintball athletes to build up
    new and successful approaches for future game titles.
    Does the opposition team speak over your crew does?
    Can they appear to be far more arranged? Paying attention to the way your competitors
    interact with each other might help enhance your team’s performance.
    Take a look at your opponents paintball gear and see if your team is lacking in that area.
    This may considerably outcome your gameplay

  15. It’s going to be finish of mine day, but before ending
    I am reading this great piece of writing to increase my know-how.

  16. Joan Thompson is surely an independent researcher and writer.

    As you’re probably aware by this time in your life, girls are irrational creatures.
    This Lavender Christmas Gift Bottle oozes pedigree charm in the resplendent frame.

  17. I was curious if you ever considered changing the page layout oof your site?

    Its very well written; I ove what youve got to say.
    But maybe you could a little more in the way of cojtent so people coujld connect with it better.
    Youve got an awful lott of text for only having
    1 oor 2 images. Maybe you could splace it out better?

    My webb page :: munnar Tour packages

  18. Hi, its pleasant piece of writing regarding media print, we all be familiar with media is a great source of information.

    Feel free to surf to my blog: webpage – Tracee,

  19. Nice post. I learn something new and challenging on sites I stumbleupon on a daily basis.
    It’s always interesting to read through content from other writers and practice a little something from their sites.

  20. I was recommended this website via my cousin. I am
    not positive whether this put up is written via him as no
    one else realize such specific about my difficulty. You’re amazing!
    Thanks!

  21. Warning: be careful with your back should you decide to move any
    heavy. Colours to avoid include bright primaries (too stimulating for a place where
    you want someone to relax and sleep), white (will show every little mark
    and is rather sterile and intimidating) and pink (you may be expecting a girl,
    but she may turn out a tomboy or a feminist and loathe pink).
    After you’ve put in the software program, you will have total and speedy accessibility to above a billion totally free MP3 songs and audio files
    on-line.

  22. You actually make it appear really easy
    along with your presentation but I to find this matter to be really something that I believe I might never understand.
    It seems too complicated and extremely extensive for me.
    I’m looking ahead in your subsequent put up, I will try to get the grasp of it!

  23. Awesome issues here. I’m very happy to see your article.
    Thank you a lot and I am looking ahead to contact you.
    Will you please drop me a mail?

  24. Games can be a great way to blow off steam after spending
    long hours staring at a textbook or re-writing notes.

    Inspired by the Modern Warfare and Black Ops story
    arc; players establish a base than mobilize an army.
    Also introduced today is the ability to watch an attack on one’s village
    while it’s happening, Level 7 Giants, and the ability to compare one’s clan to others
    in clan local leaderboards.

  25. Animal prints get a style update in a mix of tones and textures.
    This new youth market was reflected in the name ‘jean’ being formally adopted by Levi’s in the
    60s, as jeans flooded Europe and Asian markets, and became a symbol of youth, ideas, individuality
    and leisure. Wearing jeans, a jacket and a
    helmet are not enough to protect you in a spill.

  26. Thanks for one’s marvelous posting! I definitely enjoyed reading it, you are a great author.
    I will remember to bookmark your blog and may come back in the future.
    I want to encourage you to continue your great writing, have a nice morning!

  27. Fine way of explaining, and good piece of writing to take facts on the topic of my presentation subject matter,
    which i am going to deliver in institution of higher education.

  28. For a great modern twist, selectt clear lucite chairs
    will which really eliminate the visual crowding in the space.
    Tip #1: Save money by not hiring being married planner. This rule quickly scans the blogosphere of
    the question at cake cutting time.

    Feel free to visit my wweb site – wedding rings setts for 2
    000 (bit.ly)

  29. Ever since we started to work on the whole license plate purse thing, she has taken an interest into what I do, too. At first, she was not so in to cars, but she has always liked working with her hands, so I assumed that she would be a natural. Sure turns out that I was right. The fact is she is every bit as good with a muffler as with a license plate purse. Shortly I’ll start to show her the inside of an engine, and then we will be down to business.
    最も人気のあるルイヴィトンのハンドバッグ2015 http://www.appeum.com/lend/ledge-Gvm8gh.html

  30. Females find skates are additionally scale of in another way to by men’s, yet men’s and women’s shape skates tend to be generated in the same common sizes. Typically the glasses really are gradual trifocals (steeply-priced) together with the antiglare, antiscratch and then smoothly tinted. It’s the time involving industry paperbacks in addition to hardcovers.
    安いマイケルコースハンドバッグオンライン 中国製の安いマイケルコースハンドバッグを http://www.abkib.com/mind/emotion-019dbG.html

  31. Aw, this was a very nice post. Taking a few minutes and
    actual effort to produce a top notch article… but what can I say… I hesitate a lot and don’t manage to get anything done.

  32. Criminal records checks or background checks are important as these can show the history of a person. But
    you must take into consideration that the product of every search is
    focused only on verdicts and class-A felonies.
    Kansas Metropolis refers to two cities and a metropolitan area situated at the confluence of the Kansas and Missouri Rivers
    but how do you lookup criminal court circumstances in this
    state.

  33. Every weekend i used to go to see this web page, because i want enjoyment, for the reason that this this website conations actually good funny material too.

  34. Good post and straight to the point. I don’t know if this is truly the best place to ask but do you people have any ideea where to hire some professional writers? Thank you :)

  35. Wir möchten nochmals darauf hinweisen dass aus Diskretionsgründen die Kontaktaufnahme per SMS erwünscht ist.

  36. I truly wanted to develop a quick remark to express gratitude to you for those superb strategies you are showing at this website. My extended internet look up has at the end been rewarded with professional concept to share with my classmates and friends. I would tell you that most of us visitors are unquestionably fortunate to live in a good site with many special people with very beneficial pointers. I feel truly grateful to have come across your entire webpage and look forward to some more cool minutes reading here. Thanks once more for a lot of things.

  37. I used to be suggested this web site by my cousin. I’m not certain whether this submit is written by means of him as no one else understand such designated about my problem. You are amazing! Thank you!

发表评论

电子邮件地址不会被公开。 必填项已用*标注