Vulnerabilities caused by nginx fastcgi misconfiguration + Parsing Vulnerabilities

Now there must be many websites using nginx. Since the nginx Parsing Vulnerability N months ago, it has been fixed almost all the time. The general statements are written in this way.

If ($ fastcgi_script_name ~ \ .. * \/. * Php ){
Return 403;
}

When */*. php * is matched, 403 is returned.

However, some fastcgi configurations do not only support. php, but some even have configured ph * (this is what I wrote online)

In this way, the. php * cannot be matched, and the vulnerability is also caused.

This bug was discovered by a friend of mine Clouds,

The solution is to check the fastcgi configuration file to set the suffix of the file to be deny.

You can also use robots.txt/1.PhP

For example

If ($ fastcgi_script_name ~ \ .. * \/. * Ph *){
Return 403;
}

However, the best method is cgi. fix_pathinfo = 0.

From: network security technology blog (www.safe121.com)