{"id":109263,"date":"2023-07-05T21:10:21","date_gmt":"2023-07-05T19:10:24","guid":{"rendered":"https:\/\/prohoster.info\/?p=109263"},"modified":"2023-07-06T09:41:50","modified_gmt":"2023-07-06T07:41:50","slug":"uyazvimost-konfiguraczij-nginx-s-nekorrektnymi-nastrojkami-bloka-alias","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-konfiguraczij-nginx-s-nekorrektnymi-nastrojkami-bloka-alias","title":{"rendered":"Nginxi konfiguratsioonide haavatavus vale alias ploki seadistuste t\u00f5ttu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

M\u00f5ned nginx-serverid j\u00e4\u00e4vad haavatavaks Nginx Alias Traversal tehnikale, mis esitati BlackHati konverentsil juba 2018. aastal ja v\u00f5imaldab ligip\u00e4\u00e4su failidele ja kaustadele, mis asuvad v\u00e4ljaspool juurkatalooge, mida on m\u00e4\u00e4ratletud direktiivis «alias». Probleem ilmneb ainult konfiguratsioonides, kus direktiiv «alias» asub «location» ploki sees, mille parameeter ei l\u00f5ppe s\u00fcmboliga «\/», samal ajal kui «alias» l\u00f5ppeb «\/».

\"Nginxi<\/center> <\/p>\n

Probleemi tuum seisneb selles, et failid alias-direktiiviga plokkide jaoks edastatakse n\u00f5utud tee lisamise kaudu p\u00e4rast selle kaardistamist location direktiivi maskile ja m\u00e4\u00e4ratud osa tee k\u00e4rpimist. \u00dclaltoodud haavatava konfiguratsiooni puhul saab r\u00fcndaja taotleda faili «\/img..\/test.txt» ja see p\u00e4ring langeb location maski «\/img» alla, mille j\u00e4rel j\u00e4\u00e4v «..\/test.txt» lisatakse aliasi direktiivi «\/var\/images\/» teele ja l\u00f5puks n\u00f5utakse faili «\/var\/images\/..\/test.txt». Seega v\u00f5ivad r\u00fcndajad p\u00e4\u00e4seda juurde mis tahes failidele kataloogis «\/var», mitte ainult failidele «\/var\/images\/» kaustas, n\u00e4iteks nginx logifaili laadimiseks v\u00f5iks saata p\u00e4ringu «\/img..\/log\/nginx\/access.log». <\/p>\n

Konfiguratsioonides, kus alias-direktiivi v\u00e4\u00e4rtus ei l\u00f5ppe s\u00fcmboliga «\/» (n\u00e4iteks «alias \/var\/images;»), ei saa r\u00fcndaja liikuda \u00fclemisse kataloogi, kuid tal on v\u00f5imalus taotleda m\u00f5nda muud katalooge, mille nimi algab m\u00e4\u00e4ratletud konfiguratsioonist. N\u00e4iteks p\u00e4rides «\/img.old\/test.txt» v\u00f5ib p\u00e4\u00e4seda juurde «var\/images.old\/test.txt» kaustale. <\/p>\n

GitHubi repostiivide anal\u00fc\u00fcs n\u00e4itas, et konfiguratsioonivigu, mis p\u00f5hjustavad probleemi nginxis, on endiselt t\u00f5elistes projektides. N\u00e4iteks leiti probleem Bitwarden paroolihalduri serveripoolses osas ja seda oleks v\u00f5inud kasutada ligip\u00e4\u00e4suks k\u00f5ikidele failidele kataloogis \/etc\/bitwarden (p\u00e4ringud \/attachments edastati kataloogist \/etc\/bitwarden\/attachments\/), sealhulgas seal salvestatud paroolide andmebaasile «vault.db», sertifikaadile ja logidele, mille saamiseks oli piisav saata p\u00e4ringud «\/attachments..\/vault.db», «\/attachments..\/identity.pfx», «\/attachments..\/logs\/api.log» jne.

\"Nginxi<\/center>
\"Nginxi<\/center> <\/p>\n

Meetod t\u00f6\u00f6tas ka Google HPC Toolkitiga, kus p\u00e4ringud \/static suunati katalooge «..\/hpc-toolkit\/community\/front-end\/website\/static\/». R\u00fcndaja sai andmebaasi, kus oli salajane v\u00f5ti ja kasutajaandmed, saates p\u00e4ringud «\/static..\/.secret_key» ja «\/static..\/db.sqlite3».

\"Nginxi<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0441 nginx \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0438 Nginx Alias Traversal, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0430 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Blackhat \u0435\u0449\u0451 \u0432 2018 \u0433\u043e\u0434\u0443 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u043c, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u043c \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430, \u0437\u0430\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0435 «alias». \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u0441 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u043e\u0439 «alias», \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u043e\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u0431\u043b\u043e\u043a\u0430 «location», \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0441\u0438\u043c\u0432\u043e\u043b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":109264,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-109263","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nginx-i konfigureerimise haavatavus vale alias ploki seadistustega | ProHoster","description":"M\u00f5ned Nginx-serverid on haavatavad Nginx Alias Traversal tehnika suhtes, mis esitati Blackhati konverentsil juba 2018. aastal ja mis v\u00f5imaldab p\u00e4\u00e4seda juurde failidele ja kataloogidele, mis asuvad v\u00e4ljaspool juurkatalooge, nagu on m\u00e4\u00e4ratud \"alias\" direktiivis. Probleem ilmneb ainult konfigureerimistest, kus \"alias\" direktiiv on paigutatud \"location\" plokki ja selle parameeter ei l\u00f5ppe s\u00fcmboliga.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-konfiguraczij-nginx-s-nekorrektnymi-nastrojkami-bloka-alias","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 Nginx \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u043c\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 \u0431\u043b\u043e\u043a\u0430 alias | ProHoster","og:description":"\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0441 nginx \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0438 Nginx Alias Traversal, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0430 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Blackhat \u0435\u0449\u0451 \u0432 2018 \u0433\u043e\u0434\u0443 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u043c, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u043c \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430, \u0437\u0430\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0435 "alias". \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u0441 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u043e\u0439 "alias", \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u043e\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u0431\u043b\u043e\u043a\u0430 "location", \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0441\u0438\u043c\u0432\u043e\u043b","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-konfiguraczij-nginx-s-nekorrektnymi-nastrojkami-bloka-alias","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-07-05T19:10:24+00:00","article:modified_time":"2023-07-06T07:41:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/109263","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=109263"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/109263\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/109264"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=109263"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=109263"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=109263"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}