Opened 19 months ago
Last modified 19 months ago
#2396 closed defect
Disable encoded characters in URIs — at Version 1
| Reported by: | Owned by: | ||
|---|---|---|---|
| Priority: | major | Milestone: | |
| Component: | nginx-core | Version: | 1.21.x |
| Keywords: | Cc: | ||
| uname -a: | Linux 5.15.41 x86_64 | ||
| nginx -V: |
nginx version: nginx/1.21.6
built by gcc 8.3.0 (Debian 8.3.0-6) built with OpenSSL 1.1.1d 10 Sep 2019 (running with OpenSSL 1.1.1n 15 Mar 2022) TLS SNI support enabled configure arguments: --with-cc-opt='-g -O2 -fdebug-prefix-map=/home/pkg/src/nginx=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -Wno-stringop-overflow -Wno-stringop-truncation' --with-ld-opt='-Wl,-z,relro -fPIC' --conf-path=/etc/nginx/nginx.conf --add-module=../naxsi/naxsi_src/ --with-http_auth_request_module --with-http_geoip_module --with-http_ssl_module --with-http_stub_status_module --with-http_xslt_module --with-http_realip_module --with-stream --with-stream_ssl_module --with-stream_realip_module --with-stream_geoip_module --with-stream_ssl_preread_module --pid-path=/var/run/nginx.pid --lock-path=/var/lock/nginx.lock --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/body --http-proxy-temp-path=/var/lib/nginx/proxy --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --http-scgi-temp-path=/var/lib/nginx/scgi --prefix=/usr --with-debug |
||
Description (last modified by )
Hello
Similarly to 0b66bd4be777a5b79c5ae0e7dff89fc6429da0fe, maybe the check should be extended to encoded ones.
We have a configuration that use $uri and with the config below, we can trick nginx and change request body:
server {
listen 127.0.0.1:80;
server_name _;
location / {
proxy_pass http://127.0.0.1:81$uri;
}
}
server {
listen 127.0.0.1:81;
server_name _;
return 200;
}
server {
listen 127.0.0.1:81;
server_name ko;
return 418;
}
curl -v 'http://localhost/toto' => < HTTP/1.1 200 OK
curl -v 'http://localhost/toto%20HTTP/1.1%0d%0aHost:ko%0d%0a%0d%0a'
=>
GET /toto%20HTTP/1.1%0d%0aHost:ko%0d%0a%0d%0a HTTP/1.1
Host: localhost
User-Agent: curl/7.64.0
Accept: */*
< HTTP/1.1 418
< Server: nginx/1.21.6
< Date: Sat, 01 Oct 2022 12:55:15 GMT
< Content-Length: 0
< Connection: keep-alive
<
- Connection #0 to host localhost left intact
The attached patch tries to mimic fix on the commit 0b66bd4be777a5b79c5ae0e7dff89fc6429da0fe.
Same crafted curl gives me now:
< HTTP/1.1 400 Bad Request
< Server: nginx/1.21.6
What do you think ?
Regards
Change History (2)
by , 19 months ago
| Attachment: | encoded-deny.patch added |
|---|
comment:1 by , 19 months ago
| Description: | modified (diff) |
|---|
