MySQL Infobright 数据仓库快速安装笔记[原创]
快速跳转到Google SSL 中文版的网址：ggssl.com [此文被墙，无法浏览]
2010-5-21 18:46 | by
[文章作者：张宴 本文版本：v1.2 最后修改：2010.05.24 转载请注明原文链接：http://blog.zyan.cc/nginx_0day/]
注：2010年5月23日14:00前阅读本文的朋友，请按目前v1.1版本的最新配置进行设置。
昨日，80Sec 爆出Nginx具有严重的0day漏洞，详见《Nginx文件类型错误解析漏洞》。只要用户拥有上传图片权限的Nginx+PHP服务器，就有被入侵的可能。
其实此漏洞并不是Nginx的漏洞，而是PHP PATH_INFO的漏洞，详见：http://bugs.php.net/bug.php?id=50852&edit=1
例如用户上传了一张照片，访问地址为http://www.domain.com/images/test.jpg，而test.jpg文件内的内容实际上是PHP代码时，通过http://www.domain.com/images/test.jpg/abc.php就能够执行该文件内的PHP代码。
网上提供的临时解决方法有：
方法①、修改php.ini，设置cgi.fix_pathinfo = 0;然后重启php-cgi。此修改会影响到使用PATH_INFO伪静态的应用，例如我以前博文的URL：http://blog.zyan.cc/read.php/348.htm 就不能访问了。
方法②、在nginx的配置文件添加如下内容后重启：if ( $fastcgi_script_name ~ \..*\/.*php ) {return 403;}。该匹配会影响类似 http://www.domain.com/software/5.0/test.php（5.0为目录），http://www.domain.com/goto.php/phpwind 的URL访问。
方法③、对于存储图片的location{...}，或虚拟主机server{...}，只允许纯静态访问，不配置PHP访问。例如在金山逍遥网论坛、SNS上传的图片、附件，会传送到专门的图片、附件存储服务器集群上（pic.xoyo.com），这组服务器提供纯静态服务，无任何动态PHP配置。各大网站几乎全部进行了图片服务器分离，因此Nginx的此次漏洞对大型网站影响不大。
本人再提供一种修改nginx.conf配置文件的临时解决方法，兼容“http://blog.zyan.cc/demo/0day/phpinfo.php/test”的PATH_INFO伪静态，拒绝“http://blog.zyan.cc/demo/0day/phpinfo.jpg/test.php”的漏洞攻击：
也可将以下内容写在fcgi.conf文件中，便于多个虚拟主机引用：
附：文章修改历史
● [2010年05月21日] [Version 1.0] 新建
● [2010年05月23日] [Version 1.1] 针对网友michael提出的“如果构造一个形如/..trojan.jpg/dummy.php/?abcd=1，似乎可以绕过防范的nginx配置”，进行了配置修改，防范了此类情况发生。提供测试的URL如下，拒绝漏洞访问：
http://blog.zyan.cc/demo/0day/phpinfo.jpg （里面是PHP代码）
http://blog.zyan.cc/demo/0day/phpinfo.jpg/.php
http://blog.zyan.cc/demo/0day/phpinfo.jpg/dummy.php
http://blog.zyan.cc/demo/0day/phpinfo.jpg/dummy.php/?abcd=1
同时兼容正常的PATH_INFO伪静态请求，测试URL如下：
http://blog.zyan.cc/demo/0day/phpinfo.php （这是正常的PHP文件）
http://blog.zyan.cc/demo/0day/phpinfo.php/test
http://blog.zyan.cc/demo/0day/phpinfo.php/news123.html
http://blog.zyan.cc/read.php/348.htm
● [2010年05月24日] [Version 1.2] 修正文字描述错误。
注：2010年5月23日14:00前阅读本文的朋友，请按目前v1.1版本的最新配置进行设置。
昨日，80Sec 爆出Nginx具有严重的0day漏洞，详见《Nginx文件类型错误解析漏洞》。只要用户拥有上传图片权限的Nginx+PHP服务器，就有被入侵的可能。
其实此漏洞并不是Nginx的漏洞，而是PHP PATH_INFO的漏洞，详见：http://bugs.php.net/bug.php?id=50852&edit=1
例如用户上传了一张照片，访问地址为http://www.domain.com/images/test.jpg，而test.jpg文件内的内容实际上是PHP代码时，通过http://www.domain.com/images/test.jpg/abc.php就能够执行该文件内的PHP代码。
网上提供的临时解决方法有：
方法①、修改php.ini，设置cgi.fix_pathinfo = 0;然后重启php-cgi。此修改会影响到使用PATH_INFO伪静态的应用，例如我以前博文的URL：http://blog.zyan.cc/read.php/348.htm 就不能访问了。
方法②、在nginx的配置文件添加如下内容后重启：if ( $fastcgi_script_name ~ \..*\/.*php ) {return 403;}。该匹配会影响类似 http://www.domain.com/software/5.0/test.php（5.0为目录），http://www.domain.com/goto.php/phpwind 的URL访问。
方法③、对于存储图片的location{...}，或虚拟主机server{...}，只允许纯静态访问，不配置PHP访问。例如在金山逍遥网论坛、SNS上传的图片、附件，会传送到专门的图片、附件存储服务器集群上（pic.xoyo.com），这组服务器提供纯静态服务，无任何动态PHP配置。各大网站几乎全部进行了图片服务器分离，因此Nginx的此次漏洞对大型网站影响不大。
本人再提供一种修改nginx.conf配置文件的临时解决方法，兼容“http://blog.zyan.cc/demo/0day/phpinfo.php/test”的PATH_INFO伪静态，拒绝“http://blog.zyan.cc/demo/0day/phpinfo.jpg/test.php”的漏洞攻击：
location ~* .*\.php($|/)
{
if ($request_filename ~* (.*)\.php) {
set $php_url $1;
}
if (!-e $php_url.php) {
return 403;
}
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
include fcgi.conf;
}
{
if ($request_filename ~* (.*)\.php) {
set $php_url $1;
}
if (!-e $php_url.php) {
return 403;
}
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
include fcgi.conf;
}
也可将以下内容写在fcgi.conf文件中，便于多个虚拟主机引用：
if ($request_filename ~* (.*)\.php) {
set $php_url $1;
}
if (!-e $php_url.php) {
return 403;
}
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param SCRIPT_NAME $uri;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param REDIRECT_STATUS 200;
set $php_url $1;
}
if (!-e $php_url.php) {
return 403;
}
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param SCRIPT_NAME $uri;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param REDIRECT_STATUS 200;
附：文章修改历史
● [2010年05月21日] [Version 1.0] 新建
● [2010年05月23日] [Version 1.1] 针对网友michael提出的“如果构造一个形如/..trojan.jpg/dummy.php/?abcd=1，似乎可以绕过防范的nginx配置”，进行了配置修改，防范了此类情况发生。提供测试的URL如下，拒绝漏洞访问：
http://blog.zyan.cc/demo/0day/phpinfo.jpg （里面是PHP代码）
http://blog.zyan.cc/demo/0day/phpinfo.jpg/.php
http://blog.zyan.cc/demo/0day/phpinfo.jpg/dummy.php
http://blog.zyan.cc/demo/0day/phpinfo.jpg/dummy.php/?abcd=1
同时兼容正常的PATH_INFO伪静态请求，测试URL如下：
http://blog.zyan.cc/demo/0day/phpinfo.php （这是正常的PHP文件）
http://blog.zyan.cc/demo/0day/phpinfo.php/test
http://blog.zyan.cc/demo/0day/phpinfo.php/news123.html
http://blog.zyan.cc/read.php/348.htm
● [2010年05月24日] [Version 1.2] 修正文字描述错误。
dxasdsad 
2026-5-10 15:33
Yes i am totally agreed with this article and i just want say that this article is very nice and very informative article.I will make sure to be reading your blog more. You made a good point but I can't help but wonder, what about the other side? !!!!!!Thanks เว็บแทงบอลออนไลน์
seo
2026-5-10 16:06
I was surfing the Internet for information and came across your blog. I am impressed by the information you have on this blog. It shows how well you understand this subject. ทางเข้า UFABET มือถือ
dsq
2026-5-10 17:16
I am impressed. I don't think Ive met anyone who knows as much about this subject as you do. You are truly well informed and very intelligent. You wrote something that people could understand and made the subject intriguing for everyone. Really, great blog you have got here. koitoto
RAZA 
2026-5-10 17:30
I am impressed. I don't think Ive met anyone who knows as much about this subject as you do. You are truly well informed and very intelligent. You wrote something that people could understand and made the subject intriguing for everyone. Really, great blog you have got here. Coches de segunda mano en las palmas
aman223
2026-5-10 18:15
Really I enjoy your site with effective and useful information. It is included very nice post with a lot of our resources.thanks for share. i enjoy this post. daftar slot
aman223
2026-5-10 18:15
Really I enjoy your site with effective and useful information. It is included very nice post with a lot of our resources.thanks for share. i enjoy this post. daftar slot
aman223
2026-5-10 18:16
Really I enjoy your site with effective and useful information. It is included very nice post with a lot of our resources.thanks for share. i enjoy this post. daftar slot
ASDAD
2026-5-12 17:52
Only strive to mention one's content can be as incredible. This clarity with your post is superb! Thanks a lot, hundreds of along with you should go on the pleasurable get the job done. slot nagawin
seo
2026-5-12 18:31
What a thrilling post, you have pointed out some excellent points, I as well believe this is a superb website. I have planned to visit it again and again. slot gacor fujiwin88
swer
2026-5-12 18:50
Only strive to mention one's content can be as incredible. This clarity with your post is superb! Thanks a lot, hundreds of along with you should go on the pleasurable get the job done. olxtoto 4d
dasd
2026-5-12 19:51
Yes i am totally agreed with this article and i just want say that this article is very nice and very informative article.I will make sure to be reading your blog more. You made a good point but I can't help but wonder, what about the other side? !!!!!!Thanks Spring driveway cleaning
wsdasd
2026-5-12 21:22
What a fantabulous post this has been. Never seen this kind of useful post. I am grateful to you and expect more number of posts like these. Thank you very much. Honey Bee IPTV
sxgn
2026-5-13 21:52
Very efficiently written information. It will be beneficial to anybody who utilizes it, including me. Keep up the good work. For sure i will check out more posts. This site seems to get a good amount of visitors. Slot games online
asdasd
2026-5-13 22:17
I found that site very usefull and this survey is very cirious, I ' ve never seen a blog that demand a survey for this actions, very curious... زيادة متابعين تيك توك رخيص
asdasd
2026-5-13 22:17
I found that site very usefull and this survey is very cirious, I ' ve never seen a blog that demand a survey for this actions, very curious... زيادة متابعين تيك توك رخيص
分页： 33/33 
28 29 30 31 32 33 
28 29 30 31 32 33
