GNU bug report logs - #62678
[PATCH] services: nginx: Harden php-location settings.

Previous Next

Full log

View this message in rfc822 format

From: Bruno Victal <mirai <at> makinata.eu>
To: Jonathan Brielmaier <jonathan.brielmaier <at> web.de>
Cc: 62678 <at> debbugs.gnu.org
Subject: [bug#62678] [PATCH] services: nginx: Harden php-location settings.
Date: Thu, 6 Apr 2023 14:11:43 +0100

Hi Jonathan,

On 2023-04-05 21:19, Jonathan Brielmaier wrote:
> I wonder if we should at least make the HTTP_PROXY variable
> configurable. It may need to be set to something else then "" in some
> scenarios. I don't know...

No, there's no legitimate reason for this, since 'PROXY' is not
a standard HTTP header according to [1]. PROXY being passed to a cgi application
as HTTP_PROXY is what the exploit is about, since HTTP_PROXY is recognized as
a variable for configuring proxies (for curl, wget, etc.)
Allowing HTTP_PROXY to be set remotely (due to a confusion with the non-standard 'PROXY' header)
is simply incomprehensible.

Regarding user intent, that is, configuring the proxy used by the cgi application by
setting HTTP_PROXY via nginx?
I don't have this use-case but IMO it feels like an extreme poor design, since it's
exploiting a name confusion to change the system environment variables for the
cgi application.

If for some reason you really need this, you can always use the regular
nginx-location-configuration to manually craft a php-location.


[1]: https://www.iana.org/assignments/http-fields/http-fields.xhtml


Cheers,
Bruno

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.