I dropped nginx because it was really fiddly to configure and misconfiguration has potentially bad consequences.
what webserver did you not just describe?
Caddy?
Hunting for Nginx alias traversals in the wild
61–70 of 165 posts
Re: Hunting for Nginx alias traversals in the wild
#62Earlier quoted context omitted.
Falso dichotomy. Tools can be "powerful" without being easy to misconfigure. To use a carpenter example, circular saws have guard shields that snap into place if the saw is free in the air. Seems like a good thing, no? Are saws meaningfully less "powerful" because of this security feature?
Shall we make straight razors illegal too while we're at it? Let's not reduce everything to the least common denominator lest we end up like (formerly) Oregon where you couldn't pump your own gas because it was "dangerous" for the lay person.
Illegal? No, we don't need to do that. But we can certainly point out that safety razors already exist, are much easier to use safely and correctly, and do at least as good of a job for 99.9...÷ of people.
This also means that if someone chooses to use a straight razor it is immediate cause for suspicion of their reasons (e.g. it might be an aesthetic preference rather than dispassionately choosing the best tool for the job) and if they advise other people to use that tool, we can call that out as bad advice.
So we don't need to make Nginx illegal, or make that default illegal, but we can certainly point out that it's a foolish default when it offers no extra power to anyone, but offers significant risk to many.
Re: Hunting for Nginx alias traversals in the wild
#63Re: Hunting for Nginx alias traversals in the wild
#64At risk of asking a dumb question, is there any good reason that you’d want nginx to allow traversing into “..” from a URL path? It just seems like problems waiting to happen. Edit: Actually, I’m a bit lost as to what’s happening in the original vuln. http://localhost/foo../secretfile.txt gets interpreted as /var/www/foo/../secretfile.txt or whatever… but why wouldn’t a server without the vulnerability interpret http…
> Why does “..” in paths only work sometimes? That fully depends upon the file permissions. In this case, let's assume that a user has permissions to read files all the way from the web index directory (../index.html) back to the root directory (/). At that point, since they have permission to traverse down to the root directory, they now have permission to view any world viewable file that can be traversed to from t…
Isn't setting correct permissions for www-data like, the first note in a bunch of "secure your web server" tutorials? I thought if read is only set for the directory with actual public files, and not for the parent directory, there should be no traversal possible like this?
Re: Hunting for Nginx alias traversals in the wild
#65The article didn't mention permissions, would this still work if the nginx user is denied permissions on things like `/var/log`? I suspect it wouldn't but isn't the most common cause of security flaws going to be unchecked assumptions? As an aside, I didn't know Github code search accepted regex.
no it wouldn't work if the user nginx is running as didn't have read access to the directory or files
Ah then I just realized, it probably does have access to all nginx log directories, because nginx needs write permissions to them anyway, right? Now I really want to go double check all my permission setups...
Re: Hunting for Nginx alias traversals in the wild
#66Earlier quoted context omitted.
Merecat https://github.com/troglobit/merecat/
Last release 2016??
OP wanted a simple web server for serving static content. Are you aware of open CVEs? No? It's possible for software to be done you know. Just because something isn't a rolling release of change for the sake of change (like most Google crapware) doesn't mean it isn't fit for purpose.
Re: Hunting for Nginx alias traversals in the wild
#67If all you need is a simple way to serve static files that minimizes resource consumption and is reliably secure, what is the state of the art these days? In the past I would probably reach for Nginx, but I wonder if a more focused/less configurable tool would be preferable from a security standpoint.
how is a static site served from S3 considered in these parts of the interweb? i've never done this, but see it as an option, yet i never really hear others using it either.
Good Q. Using S3 as origin behind Cloudfront seems like a pretty standard AWS CDN setup for static assets... but S3 isn't a traditional web server.
Re: Hunting for Nginx alias traversals in the wild
#68Earlier quoted context omitted.
I find it hard to believe that searching for “..” would even show up in a benchmark. In any case, it seems that nginx does try to search for .. but has a bug in the corner case where the “location” doesn’t end with a slash. I assume there’s some kind of URL normalization pass that happens before the routing pass, and if the route matches part of a path component, nothing catches the .. If I’m right, this is just an I…
Yeah, this whole thing reads to me like a bug in nginx. There is no obvious reason users would need that functionality.
What are the alternarives though?
Re: Hunting for Nginx alias traversals in the wild
#69FWIW gixy (nginx configuration checker) catches this: https://github.com/yandex/gixy/blob/master/docs/en/plugins/a... (and nixos automatically runs gixy on a configuration generated through it, so the system refuses to build <3)
I just gave nix a go and so far it seems great. But do you know, if they’re a nicer options finder? The one I found where you just search all several thousand options kinda sucks. I want to just see my package (say, ssh) and just the ssh options, but the results get littered with irrelevancy.
> if they’re a nicer options finder?
> I want to just see my package (say, ssh) and just the ssh options
Re: Hunting for Nginx alias traversals in the wild
#70If all you need is a simple way to serve static files that minimizes resource consumption and is reliably secure, what is the state of the art these days? In the past I would probably reach for Nginx, but I wonder if a more focused/less configurable tool would be preferable from a security standpoint.
I use https://static-web-server.net/
Cross-platform, written in Rust, straightforward configuration, secure defaults, also has a hardened container image and a hardened NixOS module.
I wouldn't recommend Caddy. Their official docker image runs as root by default [1], and they don't provide a properly sandboxed systemd unit file [2].
[1]: https://github.com/caddyserver/caddy-docker/issues/104
[2]: https://github.com/caddyserver/dist/blob/master/init/caddy.s...
EDITED: phrasing