FWIW gixy (nginx configuration checker) catches this:
https://github.com/yandex/gixy/blob/master/docs/en/plugins/a...
(and nixos automatically runs gixy on a configuration generated through it, so the system refuses to build <3)
Hunting for Nginx alias traversals in the wild
21–30 of 165 posts
Re: Hunting for Nginx alias traversals in the wild
#22Earlier quoted context omitted.
It's generally a question of time. If you want to play the long game and collect a lot of encrypted data now, you can simply wait until it is possible to trivially decrypt, and/or start cracking now and let the years work on it. Most encryption decisions are framed as a tradeoff of the time and resources it would currently take to brute-force your way through it, and how many years before a simple attack becomes feas…
BW uses 100K rounds of PBKDF2 for the master password so I don't think that will be any time soon
BW now uses Argon2 over PBKDF. I can’t remember if that is by default, opt-in, or new accounts. But barring an argon vuln, this is even less of a concern.
Also, I think BW has been using more than 100k for some time now. Last I saw 600K was the recommendation.
Re: Hunting for Nginx alias traversals in the wild
#23If I understand correctly, this is a vulnerability in self-hosted Bitwarden only. Is that correct?
Re: Hunting for Nginx alias traversals in the wild
#24If all you need is a simple way to serve static files that minimizes resource consumption and is reliably secure, what is the state of the art these days? In the past I would probably reach for Nginx, but I wonder if a more focused/less configurable tool would be preferable from a security standpoint.
Re: Hunting for Nginx alias traversals in the wild
#25How is this not seen as a vulnerability in nginx? This behavior is utterly absurd, seems to have no beneficial purpose, and straightforwardly exploitable.
[flagged]
Re: Hunting for Nginx alias traversals in the wild
#26FWIW gixy (nginx configuration checker) catches this: https://github.com/yandex/gixy/blob/master/docs/en/plugins/a... (and nixos automatically runs gixy on a configuration generated through it, so the system refuses to build <3)
I just gave nix a go and so far it seems great.
But do you know, if they’re a nicer options finder? The one I found where you just search all several thousand options kinda sucks. I want to just see my package (say, ssh) and just the ssh options, but the results get littered with irrelevancy.
Re: Hunting for Nginx alias traversals in the wild
#27If all you need is a simple way to serve static files that minimizes resource consumption and is reliably secure, what is the state of the art these days? In the past I would probably reach for Nginx, but I wonder if a more focused/less configurable tool would be preferable from a security standpoint.
Shameless plug: Caddy does a great job here. Automatic HTTPS, written in Go so memory safety bugs are not a concern, has a solid file_server module.
Isn't everything forced to https now
Re: Hunting for Nginx alias traversals in the wild
#28How is this not seen as a vulnerability in nginx? This behavior is utterly absurd, seems to have no beneficial purpose, and straightforwardly exploitable.
[flagged]
And a good carpenter understands that tools can be better or worse, and that a good carpenter who uses bad tools will be worse off than a good carpenter who uses good tools. It's not wrong of anyone (regardless of skill level) to demand better tools; power is not a blanket excuse for poor design. You can have powerful tools with non-dangerous defaults.
Re: Hunting for Nginx alias traversals in the wild
#29How is this not seen as a vulnerability in nginx? This behavior is utterly absurd, seems to have no beneficial purpose, and straightforwardly exploitable.
[flagged]
That idiom is so dumb.
There are 1000s of jobs that are incredibly easy with the tool for exactly that job but painful without, the auto industry alone has tonnes.
Software with footguns can be improved by removing the footguns.
Re: Hunting for Nginx alias traversals in the wild
#30Earlier quoted context omitted.
Shameless plug: Caddy does a great job here. Automatic HTTPS, written in Go so memory safety bugs are not a concern, has a solid file_server module.
Isn't everything forced to https now
No.
Some things were never meant to be, like downloading CRLs over HTTPS.