Hunting for Nginx Alias Traversals in the wild
Nginx, a versatile web server pivotal to numerous internet infrastructures, has held a dominant market share since its inception in 2004, with widespread adoption across websites and Docker containers. This article delves into the intricacies of Nginx, focusing on the location and alias directives that are central to how Nginx handles specific URLs. We also explore potential vulnerabilities arisin
スラッシュã®æœ‰ç„¡ã ã‘ã§ã‚»ã‚ュリティã«ã¨ã‚“ã§ã‚‚ãªã„大穴ãŒç©ºã„ã¦ã—ã¾ã†Nginxã®ã‚ã‚ŠãŒã¡ãªè¨å®šãƒŸã‚¹ã«ã¤ã„ã¦å®Ÿä¾‹ã‚’è¸ã¾ãˆã¦å°‚門家ãŒè§£èª¬
多機能ãªã‚¦ã‚§ãƒ–サーãƒãƒ¼ã¨ã—ã¦2004å¹´ã«ç™»å ´ã—ãŸNginxã¯ã€2023å¹´6月時点ã§ã¯æ¥ç•Œãƒˆãƒƒãƒ—シェアã¨ãªã‚‹ã»ã©äººæ°—を集ã‚るサーãƒãƒ¼ã§ã™ã€‚ãã‚“ãªNginxã®è¨å®šã«ãŠã„ã¦ã€ã‚¹ãƒ©ãƒƒã‚·ãƒ¥ã‚’一ã¤ä»˜ã‘ã‚‹ã‹ä»˜ã‘ãªã„ã‹ã®å·®ã§å¤§ããªã‚»ã‚ュリティホールãŒã§ãã¦ã—ã¾ã†å•é¡Œã«ã¤ã„ã¦ã€å¤§æ‰‹ãƒ‘スワードマãƒãƒ¼ã‚¸ãƒ£ãƒ¼ã‚„Google製ã®ãƒ„ールã®ä¾‹ã‚’ã¨ã‚Šã‚ã’ã¦ã‚»ã‚ュリティアナリストã®ãƒ€ãƒ‹ã‚¨ãƒ«ãƒ»ãƒžãƒ„モトã•ã‚“ãŒãƒ–ãƒã‚°ã§è§£èª¬ã—ã¦ã„ã¾ã™ã€‚ Hunting for Nginx Alias Traversals in the wild https://labs.hakaioffsec.com/nginx-alias-traversal/ Nginxã®è¨å®šã«ã¯ã€ç‰¹å®šã®URLã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚’ã©ã†å‡¦ç†ã™ã‚‹ã¹ãã‹ã‚’記述ã§ãる「locationã€ã¨ã„ã†ãƒ‡ã‚£ãƒ¬ã‚¯ãƒ†ã‚£ãƒ–ãŒå˜åœ¨ã—ã¦ãŠã‚Šã€URLをサーãƒãƒ¼å†…ã®ãƒ•ã‚¡ã‚¤ãƒ«ã«å¯¾å¿œã•ã›ã‚‹ã®ã«ã‚ˆã利用ã•ã‚Œã¦ã„ã¾ã™ã€‚例
マッãƒãƒ³ã‚°ã‚¢ãƒ—リã§ITエンジニアã¨ãƒžãƒƒãƒã—ãŸäººã¸ã€‚「nginxã€ã‚’èªã¾ã›ã¦ã¿ã¦ä¸‹ã•ã„。変ãªèªã¿æ–¹ã‚’ã—ãŸã‚‰å¤šåˆ†å½ç‰©
ãã‚ã£ã¡ã‚‡@社畜犬X @kuwaccho0711 マッãƒãƒ³ã‚°ã‚¢ãƒ—リã§ITエンジニアã¨ãƒžãƒƒãƒã—ãŸäººã¸ 「nginxã€ã‚’èªã¾ã›ã¦ã¿ã¦ä¸‹ã•ã„。 変ãªèªã¿æ–¹ã‚’ã—ãŸã‚‰å½ç‰©ã§ã™ã€‚多分。 å‚考ã«ã—ã¦ä¸‹ã•ã„。 2022-08-28 21:57:28
NGINXã€å•†ç”¨ç‰ˆã®é‡è¦ãªæ©Ÿèƒ½ã‚’オープンソースã§ç„¡æ–™åŒ–ã€ã‚ªãƒ¼ãƒˆã‚¹ã‚±ãƒ¼ãƒ«ã‚„CI/CDフックãªã©ãƒ•ãƒ«ã‚¹ã‚¿ãƒƒã‚¯åŒ–ãªã©ã€ä»Šå¾Œã®ç™ºå±•ã«ã¤ã„ã¦ã‚³ãƒŸãƒƒãƒˆã‚’発表
NGINXã€å•†ç”¨ç‰ˆã®é‡è¦ãªæ©Ÿèƒ½ã‚’オープンソースã§ç„¡æ–™åŒ–ã€ã‚ªãƒ¼ãƒˆã‚¹ã‚±ãƒ¼ãƒ«ã‚„CI/CDフックãªã©ãƒ•ãƒ«ã‚¹ã‚¿ãƒƒã‚¯åŒ–ãªã©ã€ä»Šå¾Œã®ç™ºå±•ã«ã¤ã„ã¦ã‚³ãƒŸãƒƒãƒˆã‚’発表 オープンソースã®Webサーãƒã€ŒNGINXã€ï¼ˆã‚¨ãƒ³ã‚¸ãƒ³ã‚¨ãƒƒã‚¯ã‚¹ï¼‰ã®é–‹ç™ºå…ƒã§ã‚ã‚‹F5 Networksã¯ã€ã‚ªãƒ³ãƒ©ã‚¤ãƒ³ã‚¤ãƒ™ãƒ³ãƒˆã€ŒF5 NGINX Sprint 2022ã€ã‚’開催ä¸ã§ã™ã€‚ ãã“ã§NGINX開発ãƒãƒ¼ãƒ ã¯ã€ä»Šå¾Œã®NGIXã®ç™ºå±•ã«å‘ã‘ã¦ã€ã‚½ãƒ¼ã‚¹ã‚³ãƒ¼ãƒ‰ã‚’Mercurialã‹ã‚‰GitHubã¸ç§»è¡Œã™ã‚‹ã“ã¨ã€æœ‰å„Ÿç‰ˆã®æ©Ÿèƒ½ã‚’オープンソースã¸ç§»æ¤ã—ã¦ç„¡æ–™ã§åˆ©ç”¨å¯èƒ½ã«ã™ã‚‹ã“ã¨ã€å˜ãªã‚‹Webサーãƒæ©Ÿèƒ½ã ã‘ã§ãªãCI/CD機能ãªã©ã‚’æ‹¡å¼µã™ã‚‹ã“ã¨ãªã©ã€3ã¤ã®ç´„æŸã‚’発表ã—ã¾ã—ãŸã€‚ GM of #NGINX @rwhiteley0 has just announced three #opensource promises that will come to life
Avoiding the Top 10 NGINX Configuration Mistakes - NGINX
Analytics cookies are off for visitors from the UK or EEA unless they click Accept or submit a form on nginx.com. They’re on by default for everybody else. Follow the instructions here to deactivate analytics cookies. This deactivation will work even if you later click Accept or submit a form. Check this box so we and our advertising and social media partners can use cookies on nginx.com to better
全世界ã§ä½¿ã‚れるWebサーãƒãƒ¼ã®é–‹ç™ºå…ƒã€ŒNGINXã€ã«ãƒã‚·ã‚¢è¦å¯Ÿã®å¼·åˆ¶æœæŸ»ã€å¾“æ¥å“¡æ‹˜æŸï¼†æ©Ÿå™¨æŠ¼åŽã¸
世界ä¸ã®ã‚¦ã‚§ãƒ–サービスã§åˆ©ç”¨ã•ã‚Œã‚‹ç„¡æ–™ã‹ã¤ã‚ªãƒ¼ãƒ—ンソースã®Webサーãƒãƒ¼ã€Œnginxã€ã‚’開発ã™ã‚‹NGINXãŒãƒã‚·ã‚¢è¦å¯Ÿã‹ã‚‰ã®å¼·åˆ¶æœæŸ»ã‚’å—ã‘㟠ã“ã¨ãŒã‚ã‹ã‚Šã¾ã—ãŸã€‚ã“ã®èƒŒæ™¯ã«ã¯ã€ã€Œãƒã‚·ã‚¢ä¼æ¥ãŒnginxã®æ‰€æœ‰æ¨©ã‚’主張ã—ã¦ã„ã‚‹ã€ã¨ã„ã†å•é¡ŒãŒã‚ã‚‹ã¨ã®ã“ã¨ã€‚従æ¥å“¡ã«ã‚ˆã‚‹æƒ…å ±ã‹ã‚‰ã€è¦å¯Ÿã«ã‚ˆã£ã¦å¾“æ¥å“¡ãŒæ‹˜æŸã•ã‚Œã€æ©Ÿå™¨ãŒæŠ¼åŽã•ã‚ŒãŸã“ã¨ã‚‚明らã‹ã«ãªã£ã¦ã„ã¾ã™ã€‚ Rambler заÑвила о правах на Nginx – Ð‘Ð¸Ð·Ð½ÐµÑ â€“ КоммерÑантъ https://www.kommersant.ru/doc/4190259 Telegram: Contact @thebell_io https://t.me/thebell_io/4311 Russian police raid NGINX Moscow office | ZDNet https://www.zdnet.com/ar
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
{{#tags}}- {{label}}
{{/tags}}