cyberharsh/nginx-cve-2013-4547Docker-based lab demonstrating Nginx CVE-2013-4547 URI parsing vulnerability with step-by-step exploitation for privilege bypass and code execution.
Affected versions: Nginx 0.8.41 ~ 1.4.3 / 1.5.0 ~ 1.5.7
Reference links:
This vulnerability is not directly related to code execution; its main cause is the incorrect parsing of the request URI, resulting in an erroneous retrieval of the user-requested filename, leading to permission bypass and secondary effects such as code execution.
For example, when Nginx matches a request ending with .php, it forwards it to fastcgi for parsing. A common configuration is as follows:
location ~ \.php$ {
include fastcgi_params;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name;
fastcgi_param DOCUMENT_ROOT /var/www/html;
}
Under normal circumstances (with pathinfo disabled), only files with the .php extension are sent to fastcgi for parsing.
In the presence of CVE-2013-4547, if we request 1.gif[0x20][0x00].php, this URI matches the regex \.php$ and enters this Location block. However, after entering, Nginx mistakenly treats the requested file as 1.gif[0x20] and sets it as the value of SCRIPT_FILENAME, sending it to fastcgi.
Fastcgi then parses based on the value of SCRIPT_FILENAME, leading to a parsing vulnerability.
Therefore, we only need to upload a file ending with a space to cause PHP to parse it.
Another example: many websites restrict access to the admin panel by IP:
location /admin/ {
allow 127.0.0.1;
deny all;
}
We can request a URI like /test[0x20]/../admin/index.php. This URI does not match the /admin/ location, bypassing the IP restriction; however, the final requested file is /test[0x20]/../admin/index.php, which resolves to /admin/index.php, successfully accessing the admin panel. (This requires a directory named test : this is a characteristic of Linux systems. If a directory does not exist, even a parent directory jump will cause a "file not found" error. Windows does not have this limitation.)
Start the vulnerable environment:
docker-compose build
docker-compose up -d
After the environment starts, visit http://your-ip:8080/ to see an upload page.
This environment uses a blacklist validation, so we cannot upload files with a .php extension. We need to exploit CVE-2013-4547. Upload a file named 1.gif , note the trailing space:
Visit http://your-ip:8080/uploadfiles/1.gif[0x20][0x00].php to find that PHP has been parsed:
Note that [0x20] is a space, and [0x00] is \0. Neither character needs to be URL-encoded.