Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Can anyone explain the reason of adding the following lines, in Nginx config, when used with php-fpm

    location ~ \..*/.*\.php$ {
            return 403;
    }

Thanks.

share|improve this question

3 Answers 3

up vote 3 down vote accepted

You'd better read about the regular expression in order to understand this. The above config means that a request begin with a dot, followed by any characters, then slash, and end with something.php will be forbidden, for eg:

http://domain.com/.abc/def.php

$ telnet localhost 81
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
GET /.abc/def.php HTTP/1.0

HTTP/1.1 403 Forbidden
Server: nginx/1.0.5
Date: Wed, 19 Oct 2011 15:09:58 GMT
Content-Type: text/html
Content-Length: 168
Connection: close
share|improve this answer
    
I just wonder why the file start with a dot and end with php is being blocked. –  Howard Oct 19 '11 at 15:15

There are some long threads about cgi.fix_pathinfo = 1 and why it is a security problem on the nginx boards, in a few words without that rule in default setups one can masquerade a non php file(like a .jpg) as a php one and trick the server into processing the code in the malicious file.

Drupal, Wordpress, Squirrel etc pass their parameters to scripts through queries like /index.php?q=user/login [or user:login]. It's usually hidden in the url (cleaning/masking) yet thats how it works.

If you're using CGI to pass the request to a backend, you need to pass it in a parameter called PATH_INFO. The php developers have included a feature (stupidly enabled by default) that makes use of this.

This leads to a security problem with most common Nginx setups. Someone uploads a malicious php file to your server, say with a jpg extension. Then they go to http://server.com/sites/server.com/files/mybadfile.jpg/whatever.php

Because it ends in .php common nginx configs just pass it to the php backend as SOMESCRIPT whatever.php. Due to cgi.fix_pathinfo = 1, PHP then "fixes" the request by changing that to be SOMESCRIPT mybadfile.jpg and PATH_INFO /whatever.php and executes mybadfile.jpg as a php script.

You can imagine the rest.

what the regular expression means is that any direct request to any file in any subdirectory is to be forbidden [return 403] if the file ends with .php

[the .php$ part with $ showing the end of the line, whatever ends with that]

to understand that or regular expressions in general you should probably search the nginx documentation or regular expressions in general

share|improve this answer

See here: http://forum.nginx.org/read.php?2,88845,88996

Long story short, in some setups, someone could upload a malicious file (JPG, whatever) and get it processed by PHP.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.