Hunting for Nginx alias traversals in the wild • Hacker News Board

Re: Hunting for Nginx alias traversals in the wild

#161

Post by mholt » Wed, Jul 05, 2023, 5:07 PM UTC

cyrnel wrote: post #157

mholt wrote: post #155

Earlier quoted context omitted.

If you want a sandboxed unit file, why not just sandbox it yourself?

Sandboxing it yourself is fraught because any new feature could cause things like a syscall filter to crash the app. It has to be part of the application build/test/release process to prevent that, like it is in SWS. Besides, we should be creating and using software that is secure by default: https://www.cisa.gov/sites/default/files/2023-06/principles_...

Ah yes, I agree Linux should not let processes have a set of permissions that large by default.

Re: Hunting for Nginx alias traversals in the wild

#162

Post by NoZebra120vClip » Wed, Jul 05, 2023, 9:36 PM UTC

SV_BubbleTime wrote: post #154

NoZebra120vClip wrote: post #49

Earlier quoted context omitted.

All the replies have given random statistics, but these don't shed much light on the length of time it may take an attacker to brute-force a password, or find a chink in the armor of the vault's encryption algorithm. Now as I said, a significant threat actor with lots of time in their future plans can collect encrypted stuff such as vaults and bide their time. Someday, the decryption may be cost-effectively cheap. So…

There is practically zero scenarios where hacking ANY bitwarden account 20 years from now nets you anything useful. If the concern is general encryption when you were concerned about a 20 year from now scenario, don’t send it.

> There is practically zero scenarios where hacking ANY bitwarden account 20 years from now nets you anything useful.

Bitwarden is a password manager, yes? What about cloud accounts of someone's employer, like an AWS account that runs $1,000,000 of monthly assets? That wouldn't be valuable in 20 years?

What about VPN credentials for some big tech intranet? Yeah, hopefully they use MFA and they expire passwords before 20 years, but just in case, right?

I can certainly see nation-state actors hanging on to juicy encrypted password manager vaults, just on the off-chance they could hit the jackpot. I can think of plenty of accounts that would still be valuable and enabled 20 years from now.

Re: Hunting for Nginx alias traversals in the wild

#163

Post by SV_BubbleTime » Thu, Jul 06, 2023, 1:54 AM UTC

NoZebra120vClip wrote: post #162

SV_BubbleTime wrote: post #154

Earlier quoted context omitted.

There is practically zero scenarios where hacking ANY bitwarden account 20 years from now nets you anything useful. If the concern is general encryption when you were concerned about a 20 year from now scenario, don’t send it.

> There is practically zero scenarios where hacking ANY bitwarden account 20 years from now nets you anything useful. Bitwarden is a password manager, yes? What about cloud accounts of someone's employer, like an AWS account that runs $1,000,000 of monthly assets? That wouldn't be valuable in 20 years? What about VPN credentials for some big tech intranet? Yeah, hopefully they use MFA and they expire passwords before…

Twenty years ago we had Windows XP.

You think AWS accounts are going to have a simple password requirement in the same time?

You don’t think twenty years from now that everything is a multifactor / immutable likely-bio hardware key?

Re: Hunting for Nginx alias traversals in the wild

#164

Post by dumpsterdiver » Thu, Jul 06, 2023, 10:14 AM UTC

komali2 wrote: post #64

dumpsterdiver wrote: post #57

Earlier quoted context omitted.

> Why does “..” in paths only work sometimes? That fully depends upon the file permissions. In this case, let's assume that a user has permissions to read files all the way from the web index directory (../index.html) back to the root directory (/). At that point, since they have permission to traverse down to the root directory, they now have permission to view any world viewable file that can be traversed to from t…

Isn't setting correct permissions for www-data like, the first note in a bunch of "secure your web server" tutorials? I thought if read is only set for the directory with actual public files, and not for the parent directory, there should be no traversal possible like this?

> "Isn't setting correct permissions for www-data like, the first note in a bunch of "secure your web server" tutorials?"

It is indeed. And yet here we are.

Re: Hunting for Nginx alias traversals in the wild

#165

Post by remram » Thu, Jul 06, 2023, 8:14 PM UTC

em1sar wrote: post #109

Okay so I self-host Vaultwarden, what do I need to do to fix the vulnerability? The article mentions another flavor of the self hosted docker image though.

Vaultwarden does not include or use nginx, and neither does its official Docker image. Unless you are using nginx yourself (you'd know) this does not affect you.