Opened 2 years ago
Last modified 2 years ago
#2396 closed defect
Disable encoded characters in URIs — at Initial Version
| Reported by: | Owned by: | ||
|---|---|---|---|
| Priority: | major | Milestone: | |
| Component: | nginx-core | Version: | 1.21.x |
| Keywords: | Cc: | ||
| uname -a: | Linux 5.15.41 x86_64 | ||
| nginx -V: |
nginx version: nginx/1.21.6
built by gcc 8.3.0 (Debian 8.3.0-6) built with OpenSSL 1.1.1d 10 Sep 2019 (running with OpenSSL 1.1.1n 15 Mar 2022) TLS SNI support enabled configure arguments: --with-cc-opt='-g -O2 -fdebug-prefix-map=/home/pkg/src/nginx=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -Wno-stringop-overflow -Wno-stringop-truncation' --with-ld-opt='-Wl,-z,relro -fPIC' --conf-path=/etc/nginx/nginx.conf --add-module=../naxsi/naxsi_src/ --with-http_auth_request_module --with-http_geoip_module --with-http_ssl_module --with-http_stub_status_module --with-http_xslt_module --with-http_realip_module --with-stream --with-stream_ssl_module --with-stream_realip_module --with-stream_geoip_module --with-stream_ssl_preread_module --pid-path=/var/run/nginx.pid --lock-path=/var/lock/nginx.lock --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/body --http-proxy-temp-path=/var/lib/nginx/proxy --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --http-scgi-temp-path=/var/lib/nginx/scgi --prefix=/usr --with-debug |
||
Description
Hello
Similarly to 0b66bd4be777a5b79c5ae0e7dff89fc6429da0fe, maybe the check should be extended to encoded ones.
We have a configuration that use $uri and with the config below, we can trick nginx and change request body:
server {
listen 127.0.0.1:80;
server_name _;
location / {
proxy_pass http://127.0.0.1:81$uri;
}
}
server {
listen 127.0.0.1:81;
server_name _;
return 200;
}
server {
listen 127.0.0.1:81;
server_name ko;
return 418;
}
curl -v 'http://localhost/toto' => < HTTP/1.1 200 OK
curl -v 'http://localhost/toto%20HTTP/1.1%0d%0aHost:ko%0d%0a%0d%0a'
=>
GET /toto%20HTTP/1.1%0d%0aHost:ko%0d%0a%0d%0a HTTP/1.1
Host: localhost
User-Agent: curl/7.64.0
Accept: */*
< HTTP/1.1 418
< Server: nginx/1.21.6
< Date: Sat, 01 Oct 2022 12:55:15 GMT
< Content-Length: 0
< Connection: keep-alive
<
- Connection #0 to host localhost left intact
The following patch tries to mimic fix on the commit 0b66bd4be777a5b79c5ae0e7dff89fc6429da0fe:
diff -aruN nginx-1.21.6/src/http/ngx_http_parse.c nginx/src/http/ngx_http_parse.c
--- nginx-1.21.6/src/http/ngx_http_parse.c 2022-01-25 16:03:52.000000000 +0100
+++ nginx/src/http/ngx_http_parse.c 2022-09-30 17:38:02.176503090 +0200
@@ -1526,7 +1526,7 @@
ch = *p++;
break;
- } else if (ch == '\0') {
| ch == 0x7f) { |
return NGX_HTTP_PARSE_INVALID_REQUEST;
}
@@ -1546,6 +1546,8 @@
} else if (ch == '+') {
r->plus_in_uri = 1;
| ch == 0x7f) { |
+ return NGX_HTTP_PARSE_INVALID_REQUEST;
}
state = quoted_state;
What do you think ?
Regards
