Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hunting for Nginx alias traversals in the wild

labs.hakaioffsec.com

Post reply on HN
Print view View original

131–140 of 165 posts

Re: Hunting for Nginx alias traversals in the wild

#131

Post by leonheld »

Xophmeister wrote: post #129

OT but this isn't the first time I've seen someone mistake the verb "delve" with "dwelve": > ...we started dwelving into the code base... The author may not be a native speaker, but this is far from a judgement on their English. I'm just curious about the provenance of this mistake, given the scarcity of words that begin with "dw". At first I thought it was a typo -- especially on a QWERTY keyboard -- but I've seen i…

>I'm just curious about the provenance of this mistake

Because of English pronunciation (pronounciation? :-P). English is extremely irregular, there are a thousand of footguns in the language - both spoken and written -, so as non-native speakers we tend to make small mistakes that stick to our brains like glue, and it's very hard to get rid of (rid off? :-P).

For me it kinda makes sense to say "dwelve" because it reminds me of "dwarfs" (dwarves? :-P) that live underground!

Re: Hunting for Nginx alias traversals in the wild

#132

Post by diarrhea »

BOOSTERHIDROGEN wrote: post #122
diarrhea wrote: post #89

Earlier quoted context omitted.

I am not. Working well so far. My instance is behind Caddy, behind a secret URL path. To talk to the instance, this “pre-shares secret” needs to be known first. So far I haven’t seen any abnormal hits. I’m closing in on 3 years of using it in this setup, via Vaultwarden. I’m aware that this is security through obscurity. The instance’s accounts use strong passwords and MFA.

Is this can work for mobile devices ?

Yeah, the full URL can be specified in Bitwarden clients (browser extension, mobile app) and then never touched again. The secret path only leaks if users use Bitwarden's sharing feature. It's not a "pre-shared secret" in that sense, as it can publicly leak by design.

Re: Hunting for Nginx alias traversals in the wild

#133

Post by wccrawford »

Xophmeister wrote: post #129

OT but this isn't the first time I've seen someone mistake the verb "delve" with "dwelve": > ...we started dwelving into the code base... The author may not be a native speaker, but this is far from a judgement on their English. I'm just curious about the provenance of this mistake, given the scarcity of words that begin with "dw". At first I thought it was a typo -- especially on a QWERTY keyboard -- but I've seen i…

IMO, people learn language by seeing/hearing it used. And the internet is rife with misuse of language.

My particular pet peeve is using "weary" instead of "wary" or "leery". I've started to hear it spoke in youtube videos now, too, so it's not just a typo.

Re: Hunting for Nginx alias traversals in the wild

#134

Post by sdoering »

wccrawford wrote: post #133
Xophmeister wrote: post #129

OT but this isn't the first time I've seen someone mistake the verb "delve" with "dwelve": > ...we started dwelving into the code base... The author may not be a native speaker, but this is far from a judgement on their English. I'm just curious about the provenance of this mistake, given the scarcity of words that begin with "dw". At first I thought it was a typo -- especially on a QWERTY keyboard -- but I've seen i…

IMO, people learn language by seeing/hearing it used. And the internet is rife with misuse of language. My particular pet peeve is using "weary" instead of "wary" or "leery". I've started to hear it spoke in youtube videos now, too, so it's not just a typo.

And I learned something. Just threw it into deepl to understand the translation. Thanks for pointing it out. Would have tripped me probably.

Re: Hunting for Nginx alias traversals in the wild

#135

Post by franga2000 »

archi42 wrote: post #104
m00x wrote: post #71

Earlier quoted context omitted.

That would break so many things that it would be insane to do. You could just run nginx as a separate user with very limited rights, or just run it on Docker. This, plus updating regularly usually fixes 90% of security issues.

Most (I hope all) distributions already run nginx as a separate user. It's best practice. But that won't help if you alias to "/foo/bar/www" and the the application has a SQLite database at "/foo/bar/db.db", which the nginx user has to have access to. Same if you run it in a container (or lock down permissions using systemd).

There is no reason the web server needs to have access to the database file, the application that needs it should be running under a different user.

Re: Hunting for Nginx alias traversals in the wild

#136

Post by [deleted] »

leonheld wrote: post #131
Xophmeister wrote: post #129

OT but this isn't the first time I've seen someone mistake the verb "delve" with "dwelve": > ...we started dwelving into the code base... The author may not be a native speaker, but this is far from a judgement on their English. I'm just curious about the provenance of this mistake, given the scarcity of words that begin with "dw". At first I thought it was a typo -- especially on a QWERTY keyboard -- but I've seen i…

>I'm just curious about the provenance of this mistake Because of English pronunciation (pronounciation? :-P). English is extremely irregular, there are a thousand of footguns in the language - both spoken and written -, so as non-native speakers we tend to make small mistakes that stick to our brains like glue, and it's very hard to get rid of (rid off? :-P). For me it kinda makes sense to say "dwelve" because it re…

[deleted]

Re: Hunting for Nginx alias traversals in the wild

#137

Post by HenriTEL »

> The Google VRP Team recognized our work by awarding us a $500 reward for uncovering this vulnerability. They believed the impact on the application wasn't severe enough to warrant a larger reward.

Exposing email and private keys of GCP accounts only gives you $500 reward? WTF. Google being Google I guess.

Re: Hunting for Nginx alias traversals in the wild

#139

Post by jgalt212 »

BitPirate wrote: post #130
evgpbfhnr wrote: post #21

FWIW gixy (nginx configuration checker) catches this: https://github.com/yandex/gixy/blob/master/docs/en/plugins/a... (and nixos automatically runs gixy on a configuration generated through it, so the system refuses to build <3)

If a webserver requires additional tools for the user to avoid all these pitfalls, maybe just maybe it should re-evaluate its defaults.

Yeah, the config checker should be built-in, and if it does not pass, then one must use --force or similar to start the server.

Re: Hunting for Nginx alias traversals in the wild

#140

Post by Majromax »

Xophmeister wrote: post #129

OT but this isn't the first time I've seen someone mistake the verb "delve" with "dwelve": > ...we started dwelving into the code base... The author may not be a native speaker, but this is far from a judgement on their English. I'm just curious about the provenance of this mistake, given the scarcity of words that begin with "dw". At first I thought it was a typo -- especially on a QWERTY keyboard -- but I've seen i…

A Reddit thread on r/grammar (https://www.reddit.com/r/grammar/comments/fxahta/does_the_wo...) involves a poster asking a genuine question about the alleged word 'dwelve'. The answering commenter speculates that the author is conflating 'delve' and 'dwell'.

Another comment, added years later, admits the same confusion.

Post reply on HN