0

I just stumbled upon the 0 day exploit and some discussions about it https://forum.nginx.org/read.php?2,88845,page=3 https://serverfault.com/questions/690983/which-try-files-nginx-directive-is-best-for-the-zero-day-exploit

that zero day exploit looks scary.

And all php apps like laravel are affected? Wordpress? everything?

what other exploits are out there that I don't know about but should know about?

I am confused, and preoccupied.

So to fix nginx, I need to have something like this:

   server {
    listen 80;
   listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    server_name     dev.MyApp.com;

    root /var/www/html/dev.MyApp.com/public;

    index index.html index.htm index.php;

    access_log  /var/log/nginx/mylog.com.access.log;
    error_log  /var/log/nginx/mylog.com.error.log;

    location / {
        try_files $uri $uri/ /index.php?q=$uri&$args;
    }

 location ~ \.php$ {
        try_files $uri =404;
        proxy_intercept_errors on;
        error_page 500 501 502 503 = @fallback;
        fastcgi_buffers 8 256k;
        fastcgi_buffer_size 128k;
        fastcgi_intercept_errors on;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass unix:/var/run/php/php7.1-fpm.sock;
    }
    location @fallback {
        try_files $uri =404;
        fastcgi_buffers 8 256k;
        fastcgi_buffer_size 128k;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass unix:/var/run/php/php7.1-fpm.sock;
    }
    location ~* .(css|js|png|jpg|jpeg|gif|ico)$ { expires 1d; }

}

where try_files $uri =404; fixes the security issue. What else do i have to do? e.g. what other exploits are out there?

Toskan
  • 13,911
  • 14
  • 95
  • 185
  • This zero day exploit is from 2010. If it was actually an exploitable security vulnerability, you can guarantee it has been fixed. The best way to make sure your system is not vulnerable to bugs like this is to simply update regularly. Remember the [heartbleed bug in OpenSSL from a few years back](https://en.wikipedia.org/wiki/Heartbleed)? A patch was released in all major distributions literally the very same day it was disclosed. – Mike Sep 01 '18 at 02:29
  • @Mike there is still zero day defense found in configuration files I look at sometimes, for example this one (updated 2 months ago) see here: https://gist.github.com/kjprince/9496501#file-wordpress-nginx-config-L94 – Toskan Oct 30 '18 at 06:44

0 Answers0