I just stumbled upon the 0 day exploit and some discussions about it https://forum.nginx.org/read.php?2,88845,page=3 https://serverfault.com/questions/690983/which-try-files-nginx-directive-is-best-for-the-zero-day-exploit
that zero day exploit looks scary.
And all php apps like laravel are affected? Wordpress? everything?
what other exploits are out there that I don't know about but should know about?
I am confused, and preoccupied.
So to fix nginx, I need to have something like this:
server {
listen 80;
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
server_name dev.MyApp.com;
root /var/www/html/dev.MyApp.com/public;
index index.html index.htm index.php;
access_log /var/log/nginx/mylog.com.access.log;
error_log /var/log/nginx/mylog.com.error.log;
location / {
try_files $uri $uri/ /index.php?q=$uri&$args;
}
location ~ \.php$ {
try_files $uri =404;
proxy_intercept_errors on;
error_page 500 501 502 503 = @fallback;
fastcgi_buffers 8 256k;
fastcgi_buffer_size 128k;
fastcgi_intercept_errors on;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/var/run/php/php7.1-fpm.sock;
}
location @fallback {
try_files $uri =404;
fastcgi_buffers 8 256k;
fastcgi_buffer_size 128k;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/var/run/php/php7.1-fpm.sock;
}
location ~* .(css|js|png|jpg|jpeg|gif|ico)$ { expires 1d; }
}
where try_files $uri =404;
fixes the security issue. What else do i have to do? e.g. what other exploits are out there?