{"id":109263,"date":"2023-07-05T21:10:21","date_gmt":"2023-07-05T19:10:24","guid":{"rendered":"https:\/\/prohoster.info\/?p=109263"},"modified":"2023-07-06T09:41:50","modified_gmt":"2023-07-06T07:41:50","slug":"uyazvimost-konfiguraczij-nginx-s-nekorrektnymi-nastrojkami-bloka-alias","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-konfiguraczij-nginx-s-nekorrektnymi-nastrojkami-bloka-alias","title":{"rendered":"Vulnerabilitatea configura\u021biilor Nginx cu set\u0103ri incorrecte ale blocului alias","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Unele servere cu Nginx r\u0103m\u00e2n vulnerabile la tehnica Nginx Alias Traversal, care a fost propus\u0103 la conferin\u021ba Blackhat \u00eenc\u0103 din 2018 \u0219i permite accesul la fi\u0219iere \u0219i directoare aflate \u00een afara directorului r\u0103d\u0103cin\u0103 definit \u00een directiva \u00abalias\u00bb. Problema apare doar \u00een configura\u021biile cu directiva \u00abalias\u00bb plasat\u0103 \u00een interiorul blocului \u00ablocation\u00bb, a c\u0103rei parametru nu se \u00eencheie cu simbolul \u00ab\/\u00bb, \u00een timp ce \u00abalias\u00bb se termin\u0103 cu \u00ab\/\u00bb.

\"Vulnerabilitatea<\/center> <\/p>\n

Esenta problemei este c\u0103 fi\u0219ierele pentru blocurile cu directiva alias sunt furnizate prin ata\u0219area c\u0103ii solicitate, dup\u0103 ce aceasta a fost coresponden\u021b\u0103 cu masca din directiva location \u0219i sec\u021biunea specificat\u0103 \u00een aceast\u0103 masc\u0103 este eliminat\u0103. Pentru exemplul de mai sus al configura\u021biei vulnerabile, atacatorul poate solicita fi\u0219ierul \u00ab\/img....\/test.txt\u00bb \u0219i aceast\u0103 solicitare va intra sub masca specificat\u0103 \u00een location \u00ab\/img\u00bb, dup\u0103 care restul \u00ab....\/test.txt\u00bb va fi ata\u0219at c\u0103ii din directiva alias \u00ab\/var\/images\/\u00bb \u0219i, \u00een final, va fi solicitat fi\u0219ierul \u00ab\/var\/images\/....\/test.txt\u00bb. Astfel, atacatorii pot accesa orice fi\u0219ier din directorul \u00ab\/var\u00bb, nu doar fi\u0219ierele din \u00ab\/var\/images\/\u00bb, de exemplu, pentru a desc\u0103rca jurnalul Nginx se poate trimite o solicitare \u00ab\/img....\/log\/nginx\/access.log\u00bb. <\/p>\n

\u00cen configura\u021biile \u00een care valoarea directivelor alias nu se \u00eencheie cu simbolul \u00ab\/\u00bb (de exemplu, \u00abalias \/var\/images;\u00bb), atacatorul nu poate naviga \u00een directorul p\u0103rinte, dar poate solicita un alt director \u00een \/var, al c\u0103rui nume \u00eencepe cu cel specificat \u00een configura\u021bie. De exemplu, solicit\u00e2nd \u00ab\/img.old\/test.txt\u00bb se poate ob\u021bine acces la directorul \u00abvar\/images.old\/test.txt\u00bb. <\/p>\n

Analiza repository-urilor de pe GitHub a ar\u0103tat c\u0103 erorile care duc la problem\u0103 \u00een configura\u021bia nginx apar \u00een continuare \u00een proiecte reale. De exemplu, prezen\u021ba problemei a fost identificat\u0103 \u00een partea de server a managerului de parole Bitwarden \u0219i ar fi putut fi folosit\u0103 pentru a accesa toate fi\u0219ierele din directorul \/etc\/bitwarden (solicitarile \/attachments erau livrate din \/etc\/bitwarden\/attachments\/), inclusiv baza de date cu parolele \u00abvault.db\u00bb, certificatul \u0219i jurnalele, pentru a ob\u021bine care era suficient s\u0103 se trimit\u0103 solicit\u0103rile \u00ab\/attachments....\/vault.db\u00bb, \u00ab\/attachments....\/identity.pfx\u00bb, \u00ab\/attachments....\/logs\/api.log\u00bb \u0219i a\u0219a mai departe.

\"Vulnerabilitatea<\/center>
\"Vulnerabilitatea<\/center> <\/p>\n

Metoda a func\u021bionat de asemenea cu Google HPC Toolkit, \u00een care cererile \/static erau redirec\u021bionate c\u0103tre catalogul «../hpc-toolkit/community/front-end/website/static/». Pentru a ob\u021bine baza de date cu cheia secret\u0103 \u0219i acreditivele, atacatorul putea trimite cereri «\/static../.secret_key» \u0219i «\/static../db.sqlite3».

\"Vulnerabilitatea<\/center>
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0441 nginx \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0438 Nginx Alias Traversal, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0430 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Blackhat \u0435\u0449\u0451 \u0432 2018 \u0433\u043e\u0434\u0443 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u043c, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u043c \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430, \u0437\u0430\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0435 «alias». \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u0441 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u043e\u0439 «alias», \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u043e\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u0431\u043b\u043e\u043a\u0430 «location», \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0441\u0438\u043c\u0432\u043e\u043b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":109264,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-109263","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitatea configura\u021biilor Nginx cu set\u0103ri incorecte ale blocului alias | ProHoster","description":"Unele servere cu nginx r\u0103m\u00e2n vulnerabile la tehnica Nginx Alias Traversal, care a fost propus\u0103 la conferin\u021ba Blackhat \u00eenc\u0103 din 2018 \u0219i permite accesul la fi\u0219iere \u0219i directoare situate \u00een afara acestora.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-konfiguraczij-nginx-s-nekorrektnymi-nastrojkami-bloka-alias","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 Nginx \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u043c\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 \u0431\u043b\u043e\u043a\u0430 alias | ProHoster","og:description":"\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0441 nginx \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0438 Nginx Alias Traversal, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0430 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Blackhat \u0435\u0449\u0451 \u0432 2018 \u0433\u043e\u0434\u0443 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u043c, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u043c \u0432\u043d\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-konfiguraczij-nginx-s-nekorrektnymi-nastrojkami-bloka-alias","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-07-05T19:10:24+00:00","article:modified_time":"2023-07-06T07:41:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/109263","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=109263"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/109263\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/109264"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=109263"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=109263"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=109263"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}