all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
* [bug#62678] [PATCH] services: nginx: Harden php-location settings.
@ 2023-04-05 15:34 Bruno Victal
  2023-04-05 20:19 ` Jonathan Brielmaier
  2023-07-07 14:22 ` bug#62678: " Tobias Geerinckx-Rice via Guix-patches via
  0 siblings, 2 replies; 4+ messages in thread
From: Bruno Victal @ 2023-04-05 15:34 UTC (permalink / raw)
  To: 62678; +Cc: Bruno Victal

Incorporate advice from [2], which mitigates httpoxy[1] vulnerability and
disallows passing non-php files to the PHP backend.

[1]: <https://httpoxy.org/>
[2]: <https://www.nginx.com/resources/wiki/start/topics/examples/phpfcgi/>,
note 4.

* gnu/services/web.scm (nginx-php-location): Only pass existing php files to
backend. Mitigate httpoxy vulnerability.
---

Tested with: make check-system TESTS="nginx php-fpm"

 gnu/services/web.scm | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/gnu/services/web.scm b/gnu/services/web.scm
index d56e893527..f5ed027bb4 100644
--- a/gnu/services/web.scm
+++ b/gnu/services/web.scm
@@ -1123,6 +1123,10 @@ (define* (nginx-php-location
    (uri "~ \\.php$")
    (body (list
           "fastcgi_split_path_info ^(.+\\.php)(/.+)$;"
+          ;; Mitigate https://httpoxy.org/ vulnerabilities
+          "fastcgi_param HTTP_PROXY \"\";"
+          ;; Only pass existing php files to the backend.
+          "if (!-f $document_root$fastcgi_script_name) { return 404; }"
           (string-append "fastcgi_pass unix:" socket ";")
           "fastcgi_index index.php;"
           (list "include " nginx-package "/share/nginx/conf/fastcgi.conf;")))))

base-commit: 6311493d7a6271bfbc51f4693857f9a12fe9965d
-- 
2.39.2





^ permalink raw reply related	[flat|nested] 4+ messages in thread

* [bug#62678] [PATCH] services: nginx: Harden php-location settings.
  2023-04-05 15:34 [bug#62678] [PATCH] services: nginx: Harden php-location settings Bruno Victal
@ 2023-04-05 20:19 ` Jonathan Brielmaier
  2023-04-06 13:11   ` Bruno Victal
  2023-07-07 14:22 ` bug#62678: " Tobias Geerinckx-Rice via Guix-patches via
  1 sibling, 1 reply; 4+ messages in thread
From: Jonathan Brielmaier @ 2023-04-05 20:19 UTC (permalink / raw)
  To: 62678

I wonder if we should at least make the HTTP_PROXY variable
configurable. It may need to be set to something else then "" in some
scenarios. I don't know...




^ permalink raw reply	[flat|nested] 4+ messages in thread

* [bug#62678] [PATCH] services: nginx: Harden php-location settings.
  2023-04-05 20:19 ` Jonathan Brielmaier
@ 2023-04-06 13:11   ` Bruno Victal
  0 siblings, 0 replies; 4+ messages in thread
From: Bruno Victal @ 2023-04-06 13:11 UTC (permalink / raw)
  To: Jonathan Brielmaier; +Cc: 62678

Hi Jonathan,

On 2023-04-05 21:19, Jonathan Brielmaier wrote:
> I wonder if we should at least make the HTTP_PROXY variable
> configurable. It may need to be set to something else then "" in some
> scenarios. I don't know...

No, there's no legitimate reason for this, since 'PROXY' is not
a standard HTTP header according to [1]. PROXY being passed to a cgi application
as HTTP_PROXY is what the exploit is about, since HTTP_PROXY is recognized as
a variable for configuring proxies (for curl, wget, etc.)
Allowing HTTP_PROXY to be set remotely (due to a confusion with the non-standard 'PROXY' header)
is simply incomprehensible.

Regarding user intent, that is, configuring the proxy used by the cgi application by
setting HTTP_PROXY via nginx?
I don't have this use-case but IMO it feels like an extreme poor design, since it's
exploiting a name confusion to change the system environment variables for the
cgi application.

If for some reason you really need this, you can always use the regular
nginx-location-configuration to manually craft a php-location.


[1]: https://www.iana.org/assignments/http-fields/http-fields.xhtml


Cheers,
Bruno




^ permalink raw reply	[flat|nested] 4+ messages in thread

* bug#62678: [PATCH] services: nginx: Harden php-location settings.
  2023-04-05 15:34 [bug#62678] [PATCH] services: nginx: Harden php-location settings Bruno Victal
  2023-04-05 20:19 ` Jonathan Brielmaier
@ 2023-07-07 14:22 ` Tobias Geerinckx-Rice via Guix-patches via
  1 sibling, 0 replies; 4+ messages in thread
From: Tobias Geerinckx-Rice via Guix-patches via @ 2023-07-07 14:22 UTC (permalink / raw)
  To: Bruno Victal; +Cc: 62678-done

[-- Attachment #1: Type: text/plain, Size: 464 bytes --]

Hi Bruno,

Bruno Victal 写道:
> Incorporate advice from [2], which mitigates httpoxy[1] 
> vulnerability and
> disallows passing non-php files to the PHP backend.
>
> [1]: <https://httpoxy.org/>
> [2]: 
> <https://www.nginx.com/resources/wiki/start/topics/examples/phpfcgi/>,
> note 4.

This is a better comment than commit message.  I made it so and 
pushed your changes as commit 
cbc14b3baea457cf2718b85f767d39ff3911ce91.

Thanks!

T G-R

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 247 bytes --]

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2023-07-07 14:26 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-04-05 15:34 [bug#62678] [PATCH] services: nginx: Harden php-location settings Bruno Victal
2023-04-05 20:19 ` Jonathan Brielmaier
2023-04-06 13:11   ` Bruno Victal
2023-07-07 14:22 ` bug#62678: " Tobias Geerinckx-Rice via Guix-patches via

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.