{"id":109263,"date":"2023-07-05T21:10:21","date_gmt":"2023-07-05T19:10:24","guid":{"rendered":"https:\/\/prohoster.info\/?p=109263"},"modified":"2023-07-06T09:41:50","modified_gmt":"2023-07-06T07:41:50","slug":"uyazvimost-konfiguraczij-nginx-s-nekorrektnymi-nastrojkami-bloka-alias","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-konfiguraczij-nginx-s-nekorrektnymi-nastrojkami-bloka-alias","title":{"rendered":"Vulneraabiliteti i konfigurimeve Nginx me konfigurime t\u00eb gabuara t\u00eb blokut alias","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Disa servera me nginx mbeten t\u00eb preksh\u00ebm ndaj teknik\u00ebs Nginx Alias Traversal, e cila u propozua n\u00eb konferenc\u00ebn Blackhat q\u00eb n\u00eb vitin 2018 dhe lejon aksesin n\u00eb skedar\u00eb dhe katalog\u00eb t\u00eb vendosur jasht\u00eb direktoris\u00eb rr\u00ebnj\u00ebsore t\u00eb p\u00ebrcaktuar n\u00eb direktiv\u00ebn «alias». Problemi shfaqet vet\u00ebm n\u00eb konfigurimet me direktiv\u00ebn «alias», e vendosur brenda blokut «location», parametrat e s\u00eb cil\u00ebs nuk p\u00ebrfundojn\u00eb n\u00eb simbolet «\/», nd\u00ebrkoh\u00eb q\u00eb «alias» p\u00ebrfundon n\u00eb «\/».

\"Vulneraabiliteti<\/center> <\/p>\n

Natyra e problemit \u00ebsht\u00eb se skedar\u00ebt p\u00ebr blloqet me direktiv\u00ebn alias i n\u00ebnshtrohen d\u00ebrgimit t\u00eb rrug\u00ebs s\u00eb k\u00ebrkuar, pas p\u00ebrputhjes me modelin nga direktiva location dhe heqjes s\u00eb pjes\u00ebs s\u00eb caktuar nga kjo mask\u00eb. P\u00ebr shembullin e sip\u00ebrp\u00ebrmendur me konfigurim t\u00eb ndjeshm\u00ebris\u00eb, sulmuesi mund t\u00eb k\u00ebrkoj\u00eb skedarin \u00ab\/img..\/test.txt\u00bb dhe kjo k\u00ebrkes\u00eb do t\u00eb bjer\u00eb n\u00ebn modelin e specifikuar n\u00eb location \u00ab\/img\u00bb, pas s\u00eb cil\u00ebs bishtin e mbetur \u00ab..\/test.txt\u00bb do t\u00eb bashk\u00ebngjitet me rrug\u00ebn nga direktiva alias \u00ab\/var\/images\/\u00bb dhe n\u00eb fund do t\u00eb k\u00ebrkohet skedari \u00ab\/var\/images\/..\/test.txt\u00bb. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, sulmuesi mund t\u00eb ket\u00eb akses n\u00eb \u00e7do skedar n\u00eb katalogun \u00ab\/var\u00bb, dhe jo vet\u00ebm n\u00eb skedar\u00ebt n\u00eb \u00ab\/var\/images\/\u00bb, p\u00ebr shembull, p\u00ebr t\u00eb shkarkuar logun e nginx mund t\u00eb d\u00ebrgohet nj\u00eb k\u00ebrkes\u00eb \u00ab\/img..\/log\/nginx\/access.log\u00bb. <\/p>\n

N\u00eb konfigurimet ku vlera e direktiv\u00ebs alias nuk p\u00ebrfundon me simbolin \u00ab\/\u00bb (p.sh., \u00abalias \/var\/images;\u00bb), sulmuesi nuk mund t\u00eb kaloj\u00eb n\u00eb katalogun prind, por ka mund\u00ebsi t\u00eb k\u00ebrkoj\u00eb nj\u00eb katalog tjet\u00ebr n\u00eb \/var, fillimi i emrit t\u00eb t\u00eb cilit p\u00ebrputhet me at\u00eb t\u00eb caktuar n\u00eb konfigurim. P\u00ebr shembull, duke k\u00ebrkuar \u00ab\/img.old\/test.txt\u00bb mund t\u00eb arrihet n\u00eb katalogun \u00abvar\/images.old\/test.txt\u00bb. <\/p>\n

Analiza e repositor\u00ebve n\u00eb GitHub ka treguar se gabimet q\u00eb \u00e7ojn\u00eb n\u00eb probleme n\u00eb konfigurimin e nginx ende ndodhin n\u00eb projekte reale. P\u00ebr shembull, u identifikua nj\u00eb problem n\u00eb backend-in e menaxherit t\u00eb fjal\u00ebkalimeve Bitwarden dhe mund t\u00eb shfryt\u00ebzohej p\u00ebr t\u00eb aksesuar t\u00eb gjitha skedaret n\u00eb katalogun \/etc\/bitwarden (k\u00ebrkesat p\u00ebr \/attachments u kthenin nga \/etc\/bitwarden\/attachments\/), duke p\u00ebrfshir\u00eb baz\u00ebn e t\u00eb dh\u00ebnave me fjal\u00ebkalimet 'vault.db', certifikat\u00ebn dhe log\u00ebt, p\u00ebr t\u00eb cilat mjaftonte t\u00eb d\u00ebrgoje k\u00ebrkesat '\/attachments..\/vault.db', '\/attachments..\/identity.pfx', '\/attachments..\/logs\/api.log' etj.

\"Vulneraabiliteti<\/center>
\"Vulneraabiliteti<\/center> <\/p>\n

Metoda gjithashtu funksionoi me Google HPC Toolkit, ku k\u00ebrkesat p\u00ebr \/static u p\u00ebrcjell\u00ebn n\u00eb katalogun '..\/hpc-toolkit\/community\/front-end\/website\/static\/'. P\u00ebr t\u00eb marr\u00eb baz\u00ebn e t\u00eb dh\u00ebnave me \u00e7el\u00ebsin e mbyllur dhe kredencialet, sulmuesi mund t\u00eb d\u00ebrgonte k\u00ebrkesat '..\/static..secret_key' dhe '..\/static..db.sqlite3'.

\"Vulneraabiliteti<\/center>
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0441 nginx \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0438 Nginx Alias Traversal, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0430 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Blackhat \u0435\u0449\u0451 \u0432 2018 \u0433\u043e\u0434\u0443 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u043c, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u043c \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430, \u0437\u0430\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0435 «alias». \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u0441 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u043e\u0439 «alias», \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u043e\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u0431\u043b\u043e\u043a\u0430 «location», \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0441\u0438\u043c\u0432\u043e\u043b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":109264,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-109263","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cil\u00ebsia e konfigurimeve Nginx me cil\u00ebsime t\u00eb gabuara t\u00eb bllokut alias | ProHoster","description":"Disa server\u00eb me nginx mbeten t\u00eb vulnerab\u00ebl ndaj teknik\u00ebs Nginx Alias Traversal, e cila u propozua n\u00eb konferenc\u00ebn Blackhat n\u00eb vitin 2018 dhe lejon qasje n\u00eb skedar\u00eb dhe katalog\u00eb t\u00eb vendosur jasht\u00eb katalogut rr\u00ebnj\u00ebsor t\u00eb caktuar n\u00eb direktiv\u00ebn \"alias\". Problemi shfaqet vet\u00ebm n\u00eb konfigurime me direktiv\u00ebn \"alias\" t\u00eb vendosur brenda bllokut \"location\", parametrat e t\u00eb cilit nuk p\u00ebrfundojn\u00eb me simbolin","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-konfiguraczij-nginx-s-nekorrektnymi-nastrojkami-bloka-alias","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 Nginx \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u043c\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 \u0431\u043b\u043e\u043a\u0430 alias | ProHoster","og:description":"\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0441 nginx \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0438 Nginx Alias Traversal, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0430 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Blackhat \u0435\u0449\u0451 \u0432 2018 \u0433\u043e\u0434\u0443 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u043c, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u043c \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430, \u0437\u0430\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0435 "alias". \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u0441 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u043e\u0439 "alias", \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u043e\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u0431\u043b\u043e\u043a\u0430 "location", \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0441\u0438\u043c\u0432\u043e\u043b","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-konfiguraczij-nginx-s-nekorrektnymi-nastrojkami-bloka-alias","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-07-05T19:10:24+00:00","article:modified_time":"2023-07-06T07:41:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/109263","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=109263"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/109263\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/109264"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=109263"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=109263"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=109263"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}