ืขืืืขืืข ืกืขืจืืืขืจืก ืืื nginx ืืืืืื ืฉืคึผืืจืขืืืืืง ืคึฟืึทืจ ืื Nginx Alias โโโโTraversal ืืขืื ืืง, ืืืึธืก ืืื ืืขืืืขื ืคืืจืืขืืืืื ืืื ืื ืืืึทืงืืึทื ืืืฆืื ื ืฆืืจืืง ืืื 2018 ืืื ืึทืืึทืื ืึทืงืกืขืก ืฆื ืืขืงืขืก ืืื ืืืืจืขืงืืขืจืื ืืืึธืก ืืขื ืขื ืืืื ืึทืจืืืก ืื ืืืึธืจืฆื ืืืขืืืืืึทืืขืจ ืกืคึผืขืกืืคืืขื ืืื ืื "ืึทืืืึทืก" ืืืจืขืงืืืื. ืืขืจ ืคึผืจืึธืืืขื ืืื ืืืืื ืืื ืงืึทื ืคืืืืขืจืืืฉืึทื ื ืืื ืึทื "ืึทืืืึทืก" ืืืจืขืงืืืื ืืขืฉืืขืื ืืื ืื "ืึธืจื" ืืืึธืง, ืืขืจ ืคึผืึทืจืึทืืขืืขืจ ืคืื ืืืึธืก ืืื ื ืืฉื ืกืืฃ ืืื ืึท "/" ืืึทืจืึทืงืืขืจ, ืืฉืขืช "ืึทืืืึทืก" ืขื ืืก ืืื "/".
ืื ืขืกืึทื ืก ืคืื ืื ืคึผืจืึธืืืขื ืืื ืึทื ืืขืงืขืก ืคึฟืึทืจ ืืืึทืงืก ืืื ืื ืึทืืืึทืก ืืืจืขืงืืืื ืืขื ืขื ืืขืืขืื ืืืจื ืึทืืึทืืฉืื ื ืื ืืขืืขืื ืืจื, ื ืึธื ืืืึธืก ืจืืืื ืขืก ืืื ืื ืืึทืกืงืข ืคืื โโืื ืึธืจื ืืืจืขืงืืืื ืืื ืงืึทืืื ื ืื ืืืื ืคืื ืืขื ืืจื ืืืึธืก ืืื ืกืคึผืขืกืืคืืขื ืืื ืืขื ืืึทืกืงืข. ืคึฟืึทืจ ืืขื ืืืึทืฉืคึผืื ืคืื ืึท ืฉืคึผืืจืขืืืืืง ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืืืืื ืืืืื, ืึท ืึทืืึทืงืขืจ ืงืขื ืขื ืืขืื ืื ืืขืงืข "/img../test.txt" ืืื ืื ืืขืื ืืืขื ืืืืึทืื ืื ืืึทืกืงืข ืกืคึผืขืกืืคืืขื ืืื ืึธืจื "/img", ื ืึธื ืืืึธืก ืื ืจืืขื ืขืง "../ test.txt" ืืืขื ืืืื ืึทืืึทืืฉื ืฆื ืืขื ืืจื ืคืื ืื ืึทืืืึทืก ืืืจืขืงืืืื "/var/images/" ืืื ืืื ืึท ืจืขืืืืืึทื ืื ืืขืงืข "/var/images/../test.txt" ืืืขื ืืืื ืืขืืขืื. ืืืื, ืึทืืึทืงืขืจื ืงืขื ืขื ืึทืงืกืขืก ืงืืื ืืขืงืขืก ืืื ืื "/var" ืืืขืืืืืึทืืขืจ, ืืื ื ืื ืืืืื ืืขืงืขืก ืืื "/var/images/", ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืฆื ืึธืคึผืืึธืืืจื ืื nginx ืงืืึธืฅ, ืืืจ ืงืขื ืขื ืฉืืงื ืื ืืขืื "/img../log/ nginx/ access.log".
ืืื ืงืึทื ืคืืืืขืจืืืฉืึทื ื ืืื ืืืึธืก ืื ืืืขืจื ืคืื ืื ืึทืืืึทืก ืืืจืขืงืืืื ืืื ื ืืฉื ืกืืฃ ืืื ืึท "/" ืืึทืจืึทืงืืขืจ (ืืืฉื, "ืึทืืืึทืก / var / ืืืืืขืจ;"), ืืขืจ ืึทืืึทืงืขืจ ืงืขื ื ืืฉื ืืืืฉื ืฆื ืื ืคืึธืืขืจ ืืืขืืืืืึทืืขืจ, ืึธืืขืจ ืงืขื ืขื ืืขืื ืื ืื ืืขืจ ืืืขืืืืืึทืืขืจ ืืื / var ืืืขืืขื ืก ื ืึธืืขื ืืืืื ืืื ืกืคึผืขืกืืคืืขื ืืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืืจื ืจืืงืืืขืกืืื ื "/img.old/test.txt" ืืืจ ืงืขื ืขื ืึทืงืกืขืก ืื ืืืขืืืืืึทืืขืจ "var/images.old/test.txt".
ืึทื ืึทื ืึทืืืกืืก ืคืื ืื ืจืืคึผืึทืืึทืืึธืจืื ืืืืฃ GitHub ืืขืืืืื ืึทื ืขืจืจืึธืจืก ืืื ืื nginx ืงืึทื ืคืืืืขืจืืืฉืึทื ืืืึธืก ืคืืจื ืฆื ืืขื ืคึผืจืึธืืืขื ืืขื ืขื ื ืึธื ืืขืคึฟืื ืขื ืืื ืคืึทืงืืืฉ ืคึผืจืึทืืืฉืขืงืก. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืื ืืืึทืืืึทื ืคืื ืึท ืคึผืจืึธืืืขื ืืื ืืขืืืขื ืืืืขืงืืึทื ืืื ืื ืืึทืงืขื ื ืคืื ืื Bitwarden ืคึผืึทืจืึธื ืคืึทืจืืืึทืืืขืจ ืืื ืงืขื ืืืื ืืขืืืืื ื ืฆื ืึทืงืกืขืก ืึทืืข ืืขืงืขืก ืืื ืื /etc/bitwarden ืืืขืืืืืึทืืขืจ (ืจืืงืืืขืก ืคึฟืึทืจ / ืึทืืึทืืฉืืึทื ืฅ ืืขื ืขื ืืจืืืก ืคึฟืื /etc/bitwarden/attachments/), ืึทืจืืึทื ืืขืจืขืื ื ืื ืืึทืืึทืืืืก ืกืืึธืจื ืืึธืจื ืืื ืคึผืึทืกืืืขืจืื "ืืืึธืื. ืื", ืืึทืืืืึทืื ืืื ืืึธืืก, ืคึฟืึทืจ ืืืึธืก ืขืก ืืื ืืขื ืื ืฆื ืฉืืงื ืจืืงืืืขืก "/ืึทืืึทืืฉืืึทื ืฅ../ืืืึธืื.ืื", "/ืึทืืึทืืฉืืึทื ืฅ../identity.pfx", "/ืึทืืึทืืฉืืึทื ืฅ". ../ืืึธืืก/ืึทืคึผื.ืืึธื", ืืื"ื ื .ืคึผ.
ืืขืจ ืืืคึฟื ืืืื ืืขืืจืืขื ืืื ืื Google HPC Toolkit, ืืื / ืกืืึทืืืง ืจืืงืืืขืก ืืขื ืขื ืจืืืขืจืขืงืืื ืฆื ืื "../hpc-toolkit/community/front-end/website/static/" ืืืขืืืืืึทืืขืจ. ืฆื ืงืจืืื ืึท ืืึทืืึทืืืืก ืืื ืึท ืคึผืจืืืืึทื ืฉืืืกื ืืื ืงืจืึทืืขื ืืฉืึทืื, ืึท ืึทืืึทืงืขืจ ืงืขื ืฉืืงื ืคึฟืจืืื "/static../.secret_key" ืืื "/static../db.sqlite3".
ืืงืืจ: opennet.ru