3

The /etc/nginx/sites-available/default file that comes with nginx installation has the following content:

# You may add here your
# server {
#   ...
# }
# statements for each of your virtual hosts to this file

##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# http://wiki.nginx.org/Pitfalls
# http://wiki.nginx.org/QuickStart
# http://wiki.nginx.org/Configuration
#
# Generally, you will want to move this file somewhere, and start with a clean
# file but keep this around for reference. Or just disable in sites-enabled.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

server {
    listen 80 default_server;
    listen [::]:80 default_server ipv6only=on;

    root /usr/share/nginx/html;
    index index.html index.htm;

    # Make site accessible from http://localhost/
    server_name localhost;

    location / {
        # First attempt to serve request as file, then
        # as directory, then fall back to displaying a 404.
        try_files $uri $uri/ =404;
        # Uncomment to enable naxsi on this location
        # include /etc/nginx/naxsi.rules
    }

    # Only for nginx-naxsi used with nginx-naxsi-ui : process denied requests
    #location /RequestDenied {
    #   proxy_pass http://127.0.0.1:8080;    
    #}

    #error_page 404 /404.html;

    # redirect server error pages to the static page /50x.html
    #
    #error_page 500 502 503 504 /50x.html;
    #location = /50x.html {
    #   root /usr/share/nginx/html;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    #location ~ \.php$ {
    #   fastcgi_split_path_info ^(.+\.php)(/.+)$;
    #   # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
    #
    #   # With php5-cgi alone:
    #   fastcgi_pass 127.0.0.1:9000;
    #   # With php5-fpm:
    #   fastcgi_pass unix:/var/run/php5-fpm.sock;
    #   fastcgi_index index.php;
    #   include fastcgi_params;
    #}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #   deny all;
    #}
}


# another virtual host using mix of IP-, name-, and port-based configuration
#
#server {
#   listen 8000;
#   listen somename:8080;
#   server_name somename alias another.alias;
#   root html;
#   index index.html index.htm;
#
#   location / {
#       try_files $uri $uri/ =404;
#   }
#}


# HTTPS server
#
#server {
#   listen 443;
#   server_name localhost;
#
#   root html;
#   index index.html index.htm;
#
#   ssl on;
#   ssl_certificate cert.pem;
#   ssl_certificate_key cert.key;
#
#   ssl_session_timeout 5m;
#
#   ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
#   ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
#   ssl_prefer_server_ciphers on;
#
#   location / {
#       try_files $uri $uri/ =404;
#   }
#}

You can see there is a note "You should have "cgi.fix_pathinfo = 0; in php.ini". Above it, we also have this line:

fastcgi_split_path_info ^(.+\.php)(/.+)$;

According to the post Security issue on Nginx, PHP & fastcgi_split_path_info, we can mitigate the path info vulnerability by turning off cgi.fix_pathinfo or making use of the fastcgi_split_path_info.

Since it already makes use of the fastcgi_split_path_info directive to counter such vulnerability, why does it still say we should turn off the cgi.fix_pathinfo? If we don't, will our server be vulnerable to attack?

4

The Nginx wiki page on PHP-FPM configuration recommends turning cgi.fix_pathinfo on. Pay attention to the regex used:

fastcgi_split_path_info ^(.+?\.php)(/.*)$;

The page also provides a test where you access different URLs as listed below and check for the correct values of REQUEST_URI, SCRIPT_NAME, PATH_INFO and PHP_SELF.

/test.php
/test.php/
/test.php/foo
/test.php/foo/bar.php
/test.php/foo/bar.php?v=1 

test.php contains just <?php var_export($_SERVER)?>. This helps determine whether your setup is safe. On all URLs, your SCRIPT_NAME should be test.php. In any case, you should not see bar.php there.

  • Upvoted for suggesting a test. – Joost Mar 2 '15 at 15:06
  • I'd prefer try_files $uri = 404; as suggested here – zhangyoufu Apr 28 '15 at 11:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.