Now Reading
Looking for Nginx Alias Traversals within the wild

Looking for Nginx Alias Traversals within the wild

2023-07-03 18:56:14

Nginx, a flexible internet server pivotal to quite a few web infrastructures, has held a dominant market share since its inception in 2004, with widespread adoption throughout web sites and Docker containers. This text delves into the intricacies of Nginx, specializing in the situation and alias directives which can be central to how Nginx handles particular URLs. We additionally discover potential vulnerabilities arising from misconfigurations and display how they’ll result in safety exploits, drawing on analysis introduced on the BlackHat 2018 convention by Orange Tsai.

The information additional illustrates these factors by way of a radical examination of standard open-source repositories utilizing GitHub Code Search to determine potential Nginx configuration vulnerabilities. Actual-world case research involving Bitwarden and Google’s HPC Toolkit spotlight the numerous threat of information publicity if these vulnerabilities should not addressed. Moreover, we introduce NavGix, an automatic instrument designed to detect these vulnerabilities in a black-box method, offering complete insights into Nginx’s complexities, vulnerabilities, and potential misconfigurations.

Temporary Overview of Nginx

Nginx is a flexible internet server that may additionally perform as a reverse proxy, load balancer, mail proxy, and HTTP cache. The software program was created and publicly launched in 2004.

As per W3Tech’s knowledge, as of June 2022, Nginx holds the best market share amongst internet servers, with 33.6% of internet sites on the web using it. Moreover, in accordance with Docker, Nginx is essentially the most deployed know-how of their containers. This important reputation makes vulnerabilities associated to Nginx all of the extra vital and intriguing.

Location and Alias Directives

The situation directive is a block directive that may include different directives and is used to outline how Nginx ought to deal with requests for particular URLs, they are often outlined.

It’s usually used along with the alias directive to map URLs to particular file areas on the server. the directives might be outlined within the nginx.conf file or in a separate configuration file.

The syntax for the situation directive is as follows:

location [modifier] /path/to/URL {
    # different directives

The modifier is non-obligatory and might be one of many following:

  • =: Precise match
  • ~: Case-sensitive common expression match
  • ~*: Case-insensitive common expression match
  • ^~: Prefix match (cease looking if this matches)

Right here is an instance of the best way to use the situation directive within the nginx.conf file:

location /property/ { # defines a location block for requests matching /property
    alias /choose/manufacturing/property/; # maps the request to the property folder

Figuring out Misconfigurations

On the BlackHat 2018 convention, Orange Tsai introduced his analysis on breaking URL parsers. Amongst different spectacular findings, he demonstrated a method found in a 2016 CTF problem from HCTF, created by @iaklis.

For the method to be relevant, the next situations have to be met:

  • The location directive mustn’t have a trailing slash in its path;
  • An aliasdirective have to be current throughout the location context, and it should finish with a slash.

Reaching Influence

Within the weak instance above, Nginx will match any URLs that begin with /img and serve no matter follows that slash with the alias path /var/photographs/ prepended.

This suggests that each a request for /img/profile.jpg and a request for /imgprofile.jpg would return the identical file. As a result of for the reason that alias directive ends with a trailing slash, a further slash just isn’t needed after the matched location.

Bearing in mind that we will entry the goal folder by way of any request URL beginning with /img, we will try and entry the ever-present .. listing, thereby reaching the mother or father listing of the goal listing by issuing a request to /img.. for the given instance.

If we obtain a redirection response from Nginx, we will assume that Nginx has situated the listing and is making an attempt to redirect us to /img../, because it generally does when accessing a listing.

And we do!

Consequently, this means that any file or youngster listing throughout the mother or father listing of the goal folder will probably be accessible to us, and Nginx will readily serve them. In our lab instance, this implies we may entry all recordsdata within the /var/ folder, on condition that the goal folder within the configuration is /var/photographs/. This enables us to make the most of easy payloads, corresponding to a GET to, /img../log/nginx/entry.log to obtain a log file situated on /var/log/nginx/entry.log.

We are able to even see our earlier assessments!

The severity of this vulnerability can fluctuate considerably relying on the undertaking, extending from a negligible affect to a vital one. The diploma of its repercussions is primarily decided by whether or not the uncovered listing holds delicate knowledge that will facilitate extra assaults or end result within the disclosure of personal info.

Reaching Influence And not using a Slash on Alias

Identical vulnerability, however and not using a trailing slash on alias.

A query that will come up is whether or not this vulnerability can nonetheless be exploited with out the trailing slash on the alias directive. The reply is sure, however it will imply that utilizing traversal sequences to flee the listing would not be potential. It is because the whole lot after the matched location is appended to the alias, and appending a .. sequence to a path and not using a trailing slash would solely end in a non-existent folder title. e.g /var/photographs../

Nevertheless, we will nonetheless exploit this misbehavior to entry different directories which have a reputation beginning with the goal listing title. In consequence, we’d not be capable to entry it /var/photographs/../log/, however we may nonetheless entry a listing  /var/images_confidential by making a GET request to /img_confidential.

On this case, Nginx appends _confidential to the /var/photographs goal path, successfully serving URLs from the mixed path of /var/photographs and _confidential which leads to /var/images_confidential.

Searching Open-Supply Repositories

As a place to begin in our seek for this vulnerability, we selected to discover standard GitHub repositories that displayed this problem. Figuring out this particular vulnerability in environments with entry to supply code turns into considerably extra possible, primarily resulting from two foremost elements:

  1. Detection: Using easy code evaluation instruments, corresponding to common expression searches, permits us to successfully pinpoint doubtlessly weak Nginx configuration recordsdata inside these tasks.
  2. Exploitation: Having information of the precise goal listing that has been aliased empowers us to arrange a neighborhood occasion, study the aliased directories utilizing a neighborhood shell, and decide which recordsdata might be accessed by way of the vulnerability.

GitHub Code Search is a characteristic out there on GitHub, the web-based platform for model management and collaboration utilizing Git. This characteristic permits customers to seek for code throughout all public repositories hosted on the platform, making it particularly helpful for builders looking for examples, libraries, or options to particular coding challenges.

Moreover, GitHub Code Search might be employed to seek for snippets of weak code inside standard tasks. This may be achieved by way of a wide range of strategies, corresponding to easy string matches, common expressions, path filters, and extra. For instance, to seek for the Nginx Alias Traversal vulnerability, the next common expression can be utilized:

/location /[_.a-zA-Z0-9-/]*[^/][s]{[sn]*alias /[_.a-zA-Z0-9-/]*/;/

Upon analyzing the search outcomes for this question, it turns into evident {that a} important variety of repositories include this particular vulnerability.

As a result of inherent limitations of normal expressions, they might not be ideally suited to matching code syntax. As an example, this specific common expression won’t match weak configuration recordsdata containing feedback between the directives. Nevertheless, it serves as a place to begin for our evaluation.

Case Examine #1: Leaking Bitwarden’s vault, logs, and certificates.

Bitwarden is an open-source password supervisor that helps customers securely retailer and handle their passwords, credentials, and different delicate info. It provides options corresponding to password technology, autofill, and synchronization throughout units. Bitwarden helps numerous platforms, together with Home windows, macOS, Linux, Android, iOS, and internet browsers by way of extensions. Customers can entry their knowledge by way of an internet vault, desktop apps, cellular apps, or browser extensions.

Bitwarden additionally provides a self-hosted option for individuals who need to preserve their very own server, which is the one we’re going to study.

If we seek for methods to create a self-hosted occasion of the Bitwarden server, one of many introduced methods is thru the Unified docker method, which is a setup made for simplifying the deployment of the platform.

100K+ downloads!

Since our common expression gave a match for Bitwarden’s repository, we began dwelving into the code base trying to find doubtlessly weak Nginx configurations, which is after we discovered the next contained in the folder for the unified docker setup.

If this config is used, then it means all recordsdata on /and many others/bitwarden/attachments/ will probably be accessible on the URL /attachments, however trying again on the exploit particulars, this additionally signifies that any recordsdata current on /and many others/bitwarden/ will probably be downloadable additionally.

However let’s not get forward of ourselves, we first should assess the affect of the publicity. To try this, we will both discover the code base or hearth up a neighborhood occasion and record the listing with a neighborhood shell.

Wanting into the Dockerfile for that picture, we discover extra information about that listing and what recordsdata it may include:

ENV BW_DB_FILE="/and many others/bitwarden/vault.db"

It looks like this setting variable units the place the vault database is saved, and we will see that vault.db is situated on /and many others/bitwarden.

Bitwarden solely saves the database in that location if the person chooses to make use of SQLite as a database supplier.

Subsequently, if we problem an unauthenticated request to http://<occasion>/attachments../vault.db, we’ll obtain your entire Bitwarden SQLite3 database.

We are able to additionally fetch log recordsdata, which have a predictable filename and may all be downloaded by accessing the next paths:

See Also

  • /attachments../logs/api.log
  • /attachments../logs/admin.log
  • /attachments../logs/id.log
  • /attachments../logs/notifications.log

And, after all, the certificates file was additionally uncovered in that folder. To entry it, all you would wish to do is problem a request to /attachments../id.pfx.

The info safety keys have been additionally accessible, however these didn’t have a predictable filename, due to this fact, leaking them was not potential.

This vulnerability has been disclosed to Bitwarden and has since then been fastened. Bitwarden issued a US$6000 bounty, which is the best bounty they issued on their HackerOne program.

Case Examine #2: Google HPC Toolkit – Leaking Google Cloud Credentials

Throughout our foray by way of GitHub, we chanced upon a software program resolution developed by Google, often known as the Cloud HPC Toolkit. This was launched in 2022, designed as a sturdy framework to facilitate the deployment of high-performance computing (HPC) environments on Google Cloud.

The HPC Toolkit boasts a Django-based internet utility front-end, granting customers the power to handle their HPC environments conveniently through an internet interface.

Upon scrutinizing the configuration part recognized by our common expression, we found {that a} weak path had certainly been outlined. This path was aliased to ../hpc-toolkit/group/front-end/web site/static/, implying that issuing a request to /static../ would offer us with entry to the web site folder.

Apparently, we discovered that the SQLite database was additionally uncovered inside this folder and might be accessed by way of a particular URL:

curl http://<frontend URL>/static../db.sqlite3 -O

Furthermore, the Django secret key was accessible on the following location:


Getting access to this database is extremely vital for the appliance, as the first perform of the HPC Toolkit seems to be the orchestration of large-scale Google Cloud sources. Within the occasion of a compromise, an attacker may doubtlessly acquire management over a sufferer’s GCP account credentials, that are saved within the SQLite database.

sqlite> choose * from ghpcfe_credential;
1|manufacturing key|{
  "sort": "service_account",
  "project_id": "andunduaindadaww",
  "private_key_id": "3acb9f[... redacted from report ...]7c69",
  "private_key": "-----BEGIN PRIVATE KEY-----nMIIEv[... redacted from report ...] 5Kdkvg=n-----END PRIVATE KEY-----n",
  "client_email": "adwaw[...].com",
  "client_id": "105114036295455180401",
  "auth_uri": "",
  "token_uri": "",
  "auth_provider_x509_cert_url": "",
  "client_x509_cert_url": ""

The Google VRP Workforce acknowledged our work by awarding us a $500 reward for uncovering this vulnerability. They believed the affect on the appliance wasn’t extreme sufficient to warrant a bigger reward. I toyed with the concept of debating the reward quantity with them, however in the end determined towards it. In spite of everything, the popularity of our efforts was a reward in itself, and that was greater than sufficient for us.

There are a number of strategies to detect this vulnerability with out necessitating entry to the Nginx configuration file. Initially, potential location aliases might be recognized by extracting hyperlinks from the HTML source-code on the web site’s foremost web page. Subsequently, listing traversal might be tried utilizing the strategies outlined within the earlier sections of this report.

Within the absence of extractable hyperlinks, it’s possible to carry out a minor brute-force assault focusing on widespread aliases. The following record has demonstrated promising outcomes throughout our testing section:

	var dictionary = []string{

An automatic instrument, NavGix, has been created to help within the enumeration and testing of aliased directories for traversal vulnerabilities. It’s publicly out there for obtain and use on its respective GitHub web page.

Pattern utilization of navgix

Upon the identification of a listing prone to traversal by NavGix, it turns into potential to make use of extra instruments to fuzz for different accessible folders or recordsdata throughout the traversed listing. The first goal right here ought to be to find recordsdata of curiosity that might doubtlessly present additional affect, corresponding to a configuration file containing secrets and techniques, log recordsdata, or source-code.


Wrapping up, whereas Nginx is a strong and extremely versatile instrument that fuels a good portion of the web, it is simply prone to sure inconsistencies. These potential pitfalls are sometimes a results of misconfigurations, which might inadvertently remodel this dependable powerhouse right into a potential weak hyperlink. Nginx’s strategy to safety leaves a major onus on builders to keep away from hazardous configurations, underscoring the significance of thorough understanding and cautious implementation.

Our journey by way of the world of open-source repositories and real-life case research like Bitwarden and Google’s HPC Toolkit underlines simply how important these vulnerabilities might be. It is a sobering reminder that even essentially the most dependable techniques can have their Achilles’ heel.

Source Link

What's Your Reaction?
In Love
Not Sure
View Comments (0)

Leave a Reply

Your email address will not be published.

2022 Blinking Robots.
WordPress by Doejo

Scroll To Top