Common NGINX Misconfigurations That Leave Your Web Server Open ...

on YouTube ↗21m

" summary

Detectify researchers download and analyze 50,000 nginx configs with Google BigQuery and shell tooling and report concrete findings: a global missing root serves sensitive files, off-by-slash alias traversal lets attackers read parent folders, CRLF injection via $uri injects headers and bodies, and careless regex proxy_pass host header injection enables cache poisoning and serving attacker content; demos show exploits working and remediations are precise (use request_uri, append slashes, strict regex, specific paths).

AI-written summary · about

" chapters (5)

1. 0:00Intro
2. 3:03Missing root directive
3. 4:28Off-by-slash
4. 10:13CRLF-injection via Suri
5. 15:52proxy-pass via regex

" related talks

• 48mA Weakness In Chrome & A New Hacking TechniqueGil Cohen, Omri Inbar · Global AppSec Dublin 2023
• 45mNginx: The power withinHelgi Þormar Þorbjörnsson · Dutch PHP Conference 2013
• 56mModern Web Vulnerabilities 2020Erlend Oftedal · NDC Security Oslo 2020
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018
• 58mModern web application bugsErlend Oftedal · NDC Minnesota 2019
• 01h 04mServer-Side Browsing Considered HarmfulNicolas Gregoire · OWASP AppSec Research (AppSecEU) 2015
• 47mOptimizing nginx – from Beginner to Expert to CrazyArne Blankerts · International PHP Conference Spring 2018