{"id":109263,"date":"2023-07-05T21:10:21","date_gmt":"2023-07-05T19:10:24","guid":{"rendered":"https:\/\/prohoster.info\/?p=109263"},"modified":"2023-07-06T09:41:50","modified_gmt":"2023-07-06T07:41:50","slug":"uyazvimost-konfiguraczij-nginx-s-nekorrektnymi-nastrojkami-bloka-alias","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-konfiguraczij-nginx-s-nekorrektnymi-nastrojkami-bloka-alias","title":{"rendered":"Nginxi konfiguratsioonide haavatavus vale alias-bloki seadistamisega","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

M\u00f5ned Nginx serverid j\u00e4\u00e4vad haavatavaks Nginx Alias Traversal tehnika suhtes, mis esitati Blackhat konverentsil juba 2018. aastal ja v\u00f5imaldab p\u00e4\u00e4seda failidele ja kataloogidele, mis asuvad v\u00e4ljaspool juurkatalooge, mis on m\u00e4\u00e4ratud direktiivis \u00abalias\u00bb. Probleem ilmneb ainult konfiguratsioonides, kus \u00abalias\u00bb direktiiv asub \u00ablocation\u00bb ploki sees ja mille parameeter ei l\u00f5pe t\u00e4hisega \u00ab\/\u00bb, samas kui \u00abalias\u00bb l\u00f5peb t\u00e4hisega \u00ab\/\u00bb.

\"Nginxi<\/center> <\/p>\n

Probleemi olemus seisneb selles, et failid \u00abalias\u00bb direktiiviga plokkides edastatakse, lisades n\u00f5utud teed p\u00e4rast selle vastandamist \u00ablocation\u00bb direktiivi maskiga ja eemaldades maskeeritud tee osa. \u00dclaltoodud haavatava konfiguratsiooni puhul v\u00f5ib r\u00fcndaja k\u00fcsida faili \u00ab\/img....\/test.txt\u00bb ja see p\u00e4ring langeb kokku location maskiga \u00ab\/img\u00bb, mille j\u00e4rel j\u00e4\u00e4v osa \u00ab....\/test.txt\u00bb lisatakse direktiivist \u00abalias\u00bb saadud teele \u00ab\/var\/images\/\u00bb, tulemuseks on faili \u00ab\/var\/images\/....\/test.txt\u00bb p\u00e4rimine. Seega v\u00f5ivad r\u00fcndajad p\u00e4\u00e4seda juurde igasugustele failidele kataloogis \u00ab\/var\u00bb, mitte ainult failidele \u00ab\/var\/images\/\u00bb, n\u00e4iteks nginx logi laadimiseks piisab p\u00e4ringu saatmisest \u00ab\/img....\/log\/nginx\/access.log\u00bb. <\/p>\n

Konfiguratsioonides, kus \u00abalias\u00bb direktiivi v\u00e4\u00e4rtus ei l\u00f5pe t\u00e4hisega \u00ab\/\u00bb (n\u00e4iteks \u00abalias \/var\/images;\u00bb), ei saa r\u00fcndaja liikuda \u00fclemisse kataloogi, kuid tal on siiski v\u00f5imalik k\u00fcsida muid katalooge, mille nimi algab sama nimelahendusega. N\u00e4iteks k\u00fcsides \u00ab\/img.old\/test.txt\u00bb on v\u00f5imalik p\u00e4\u00e4seda katalooge \u00abvar\/images.old\/test.txt\u00bb. <\/p>\n

GitHubi reposte anal\u00fc\u00fcs n\u00e4itas, et Nginx seadistamise vead, mis p\u00f5hjustavad probleemi, esinevad endiselt reaalsetes projektides. N\u00e4iteks tuvastati probleem Bitwarden paroolihalduri serveriosast, mis v\u00f5is olla kasutatud, et p\u00e4\u00e4seda k\u00f5ikidele failidele kataloogis \/etc\/bitwarden (p\u00e4ringud \/attachments edastati failist \/etc\/bitwarden\/attachments\/), sealhulgas seal hoitud paroolide andmebaas \u00abvault.db\u00bb, sertifikaat ja logid, mille saamiseks piisab p\u00e4ringute saatmisest \u00ab\/attachments....\/vault.db\u00bb, \u00ab\/attachments....\/identity.pfx\u00bb, \u00ab\/attachments....\/logs\/api.log\u00bb jne.

\"Nginxi<\/center>
\"Nginxi<\/center> <\/p>\n

Meetod t\u00f6\u00f6tas ka Google HPC Toolkiti puhul, kus p\u00e4ringud \/static suunati katalooge «..\\\/hpc-toolkit\\\/community\\\/front-end\\\/website\\\/static\\\/». Suletud v\u00f5tmega andmebaasi ja kasutajatunnuste saamiseks v\u00f5is r\u00fcndaja saata p\u00e4ringud «\\\/static..\\\/\\.secret_key» ja «\\\/static..\\\/db.sqlite3».

\"Nginxi<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0441 nginx \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0438 Nginx Alias Traversal, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0430 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Blackhat \u0435\u0449\u0451 \u0432 2018 \u0433\u043e\u0434\u0443 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u043c, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u043c \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430, \u0437\u0430\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0435 «alias». \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u0441 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u043e\u0439 «alias», \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u043e\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u0431\u043b\u043e\u043a\u0430 «location», \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0441\u0438\u043c\u0432\u043e\u043b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":109264,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-109263","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nginxi haavatavus vale alias-blooke seadistumise t\u00f5ttu | ProHoster","description":"M\u00f5ned nginx-serverid j\u00e4\u00e4vad haavatavaks Nginx Alias Traversal tehnika suhtes, mis esitati Blackhati konverentsil juba 2018. aastal ja v\u00f5imaldab p\u00e4\u00e4seda juurde failidele ja kataloogidele, mis asuvad v\u00e4ljaspool.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-konfiguraczij-nginx-s-nekorrektnymi-nastrojkami-bloka-alias","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 Nginx \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u043c\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 \u0431\u043b\u043e\u043a\u0430 alias | ProHoster","og:description":"\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0441 nginx \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0438 Nginx Alias Traversal, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0430 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Blackhat \u0435\u0449\u0451 \u0432 2018 \u0433\u043e\u0434\u0443 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u043c, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u043c \u0432\u043d\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-konfiguraczij-nginx-s-nekorrektnymi-nastrojkami-bloka-alias","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-07-05T19:10:24+00:00","article:modified_time":"2023-07-06T07:41:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/109263","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=109263"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/109263\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/109264"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=109263"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=109263"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=109263"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}