Mamwe maseva eNginx anoramba ari panjodzi kune iyo Nginx Alias ββββTraversal tekinoroji, iyo yakatsanangurwa pamusangano weBlackhat kumashure muna 2018 uye inobvumira kuwana mafaera uye madhairekitori ari kunze kwemudzi dhairekitori inotsanangurwa mu "alias" kuraira. Dambudziko rinongowanikwa mukumisikidzwa ne "alias" rairo rakaiswa mukati me "nzvimbo" block iyo parameter isingapere ne "/" hunhu, nepo "alias" ichipera ne "/".
Chakanyanya chedambudziko ndechekuti mafaera ezvivharo ane alias rairo anoshumirwa nekubatanidza nzira yakakumbirwa, mushure mekuienzanisa nemask kubva kunzvimbo yekuraira uye kucheka chikamu chegwara rakatsanangurwa mune iyi mask. Semuenzaniso wegadziriro isina njodzi yaratidzwa pamusoro, munhu anorwisa anogona kukumbira faira "/img../test.txt" uye chikumbiro ichi chinowira pasi pe "/img" mask yakatsanangurwa munzvimbo, mushure mezvo muswe wasara ".. /test.txt" ichanamirwa kugwara kubva kune alias rairo "/var/images/" uye inozopedzisira yakumbira faira "/var/images/../test.txt". Saka, vanorwisa vanogona kuwana chero mafaira mu "/ var" dhairekitori, uye kwete mafaera chete mu "/ var/ mifananidzo/", semuenzaniso, kurodha nginx log, unogona kutumira chikumbiro "/img../log/ nginx/ access.log".
Muzvigadziriso umo kukosha kweiyo alias kuraira hakupere ne "/" hunhu (semuenzaniso, "alias / var / mifananidzo;"), anorwisa haagone kuchinja kune dhairekitori revabereki, asi anogona kukumbira rimwe dhairekitori mu / var. ane zita rinotanga nerimwechete rakatsanangurwa mukugadzirisa. Semuenzaniso, nekukumbira "/img.old/test.txt" unokwanisa kuwana dhairekitori "var/images.old/test.txt".
Ongororo yezvinyorwa paGitHub yakaratidza kuti zvikanganiso munginx kumisikidzwa zvinotungamira kune dambudziko zvichiri kuitika mumapurojekiti chaiwo. Semuenzaniso, dambudziko rakaonekwa kumashure kweBitwarden password maneja uye rinogona kushandiswa kuwana mafaera ese mu /etc/bitwarden dhairekitori (/ zvikumbiro zvakanamirwa zvakapihwa kubva /etc/bitwarden/attachments/), kusanganisira "vault". .db", chitupa nematanda, kuwana izvo zvaive zvakakwana kutumira zvikumbiro "/attachments../vault.db", "/attachments../identity.pfx", "/attachments../logs/api.log ", nezvimwewo .P.
Iyo nzira yakashandawo neGoogle HPC Toolkit, iyo yakaendesazve / static zvikumbiro kune "../hpc-toolkit/community/front-end/website/static/" dhairekitori. Kuti uwane dhatabhesi rine kiyi yakavanzika uye zvitupa, munhu anorwisa anogona kutumira zvikumbiro "/static../.secret_key" uye "/static../db.sqlite3".
Source: opennet.ru