ืงืขืจืขืงืืืื ืจืืืืกืื ืคืื PHP 7.3.11, 7.1.33 ืืื 7.2.24, ืืื ืืืึธืก ืงืจืืืืฉ (CVE-2019-11043) ืืื ืื PHP-FPM (FastCGI Process Manager) ืคืึทืจืืขื ืืขืจืื ื, ืืืึธืก ืึทืืึทืื ืืืจ ืฆื ืจืืืึธืืืื ืืืกืคืืจื ืืืื ืงืึธื ืืืืฃ ืื ืกืืกืืขื. ืฆื ืืึทืคืึทืื ืกืขืจืืืขืจืก ืืืึธืก ื ืืฆื PHP-FPM ืืื ืงืึทื ืืืฉืึทื ืืงืฉืึทื ืืื Nginx ืฆื ืืืืคื PHP ืกืงืจืืคึผืก, ืขืก ืืื ืฉืืื ืขืคื ืืืขื ืื ืืืฆื .
ืื ืืึทืคืึทืื ืืื ืืขืืืขื ืืื nginx ืงืึทื ืคืืืืขืจืืืฉืึทื ื ืืื ืืืึธืก ืคืึธืจืืืขืจืืื ื ืฆื PHP-FPM ืืื ืืืจืืืขืงืึธืื ืืืจื ืกืขืคึผืขืจืืืืื ื ืคึผืึทืจืฅ ืคืื ืื URL ื ืืฆื "fastcgi_split_path_info" ืืื ืืืคืืื ืื ื ืื PATH_INFO ืกืืืืืืข ืืืึทืืขืืืืืง, ืึธืืขืจ ืึธื ืขืจืฉืืขืจ ืงืึธื ืืจืึธืืืจื ืื ืขืงืืืกืืขื ืฅ ืคืื ืืขืจ ืืขืงืข ื ืืฆื ืื "try_files $fastcgi_script_name" ืืืจืขืงืืืื ืึธืืขืจ ืื "ืืืื (!-ืค $) ืืึธืงืืืขื ื_ืจืึธืึธื$ืคืึทืกืืงืื_ืกืงืจืืคึผื_ื ืึทืืข)". ืื ืคึผืจืึธืืืขื ืืื ืืืื ืืื ืื ืกืขืืืื ืืก ืืขืคึฟืื ื ืคึฟืึทืจ ืื NextCloud ืคึผืืึทืืคืึธืจืืข. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืงืึทื ืคืืืืขืจืืืฉืึทื ื ืืื ืกืืจืึทืงืืฉืขืจื ืืื:
ืึธืจื ~ [^/]\.ืคืคึผ (/|$) {
ืคืึทืกืืงืื_ืกืคึผืืื_ืคึผืึทืื_ืืื ืคึฟืึธ ^(.+?\.ืคืคึผ)(/.*)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_pass php:9000;
}
ืืืจ ืงืขื ืขื ืฉืคึผืืจ ืื ืืึทืืืึธืืข ืคืื โโืืขื ืคึผืจืึธืืืขื ืืื ืื ืคืึทืจืฉืคึผืจืืืืื ื ืงืืฅ ืืืืฃ ืื ืืืขืืขืจ: , , , , , , . ืืื ืึท ืืืึธืจืงืึทืจืึธืื ื, ืืืจ ืงืขื ืขื ืืืืื ืึท ืืฉืขืง ืคึฟืึทืจ ืื ืขืงืืืกืืขื ืฅ ืคืื ืื ืืขืืขืื PHP ืืขืงืข ื ืึธื ืื "fastcgi_split_path_info" ืฉืืจื:
try_files $fastcgi_script_name =404;
ืืขืจ ืคึผืจืึธืืืขื ืืื ืืขืคึฟืืจื ืืืจื ืึท ืืขืืช ืืืขื ืืึทื ืืคึผืืึทืืืืืื ื ืคึผืืื ืืขืจื ืืื ืึท ืืขืงืข . ืืืขื ืกืืื ืื ื ืึท ืืืึทืื, ืขืก ืืื ืื ืืขื ืืืขื ืึทื ืื ืืืขืจื ืคืื ืื PATH_INFO ืื ืืืืืจืึทื ืืขื ืึทื ืืืขืจืืึทืืึทืื ืืืื ืึทื ืืืึทืืื ืึท ืคึผืจืขืคืืงืก ืืืึธืก ืืืืึทืื ืืขื ืืจื ืฆื ืื PHP ืฉืจืืคื.
ืืืื ืื fastcgi_split_path_info ืืืจืขืงืืืื ืกืคึผืขืฆืืคืืฆืืจื ืกืคึผืืืืื ื ืื ืฉืจืืคื ืืจื ื ืืฆื ืึท ื ืขืืืืื ืข-ืฉืคึผืืจืขืืืืืง ืจืขืืืืขืจ ืืืืกืืจืืง (ืืืฉื, ืคืืืข ืืืืฉืคืืื ืคึฟืึธืจืฉืืึธืื ื ืืฆื "^(.+?\.ืคืคึผ)(/.*)$"), ืึท ืึทืืึทืงืขืจ ืงืขื ืขื ืฉืืจ ืึทื ืึท ืืืืืืง ืืืขืจื ืืื ืืขืฉืจืืื ืฆื ืื PATH_INFO ืกืืืืืืข ืืืึทืืขืืืืืง. ืืื ืืขื ืคืึทื, ื ืึธื ืื ืืืจืืคืืจืื ื ืฉืจืืืื path_info[0] ืฆื ื ืื ืืื ืจืืคื FCGI_PUTENV.
ืืืจื ืืขืื ืึท URL ืคืึธืจืืึทืืืขื ืืืืฃ ืึท ืืืืขืจ ืืืขื, ืึท ืึทืืึทืงืขืจ ืงืขื ืขื ืืขืจืืจืืืื ืึท ืืืขืจืจืืง ืคืื ืื path_info ืืืึทืื ืฆื ืืขืจ ืขืจืฉืืขืจ ืืืื ืคืื ืื "_fcgi_data_seg" ืกืืจืืงืืืจ, ืืื ืฉืจืืืื ืึท ื ืื ืฆื ืืขื ืืืืข ืืืขื ืคืืจื ืฆื ืื ืืึทืืืขืืื ื ืคืื ืื "char * pos" ืืืึทืื ืฆื ืึท ืคืจืืขืจ ืืืื ืืืงืึธืจื ืืขืื ื. ืืขืจ ืืืืึทืืขืจ ืืขืจืืคึฟื FCGI_PUTENV ืืืขื ืึธืืืืขืจืจืืื ืื ืืึทืื ืืื ืืขื ืืึผืจืื ืืื ืึท ืืืขืจื ืืืึธืก ืื ืึทืืึทืงืขืจ ืงืขื ืขื ืงืึธื ืืจืึธืืืจื. ืื ืกืคึผืขืกืืคืืขื ืืึผืจืื ืืืื ืกืืึธืจื ืื ืืืึทืืืขืก ืคืื ืื ืืขืจืข FastCGI ืืืขืจืืึทืืึทืื, ืืื ืืืจื ืฉืจืืืื ืืืืขืจ ืืึทืื, ืึท ืึทืืึทืงืขืจ ืงืขื ืขื ืืึทืื ืึท ืคืืงืืืฉ ืคืคึผ_VALUE ืืืึทืืขืืืืืง ืืื ืืขืจืืจืืืื ืื ืืืจืืคืืจืื ื ืคืื ืืืืขืจ ืงืึธื.
ืืงืืจ: opennet.ru