# Some security vulnerable **URL:** \ **Category:** NGINX\ **Created:** [June 5, 2011, 12:02pm UTC](https://www.ruby-forum.com/t/some-security-vulnerable/207885 "2011-06-05T12:02:06Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\ **Post date:** [June 5, 2011, 12:02pm UTC](https://www.ruby-forum.com/t/some-security-vulnerable/207885/1 "2011-06-05T12:02:06Z")
What do you guys think about implement this into nginx just like it is in apache? if ( $fastcgi\_script\_name ~ ..\*/.\*php ) { return 403; } because without that some servers which allows to upload images are vulnerable to external exploits. Posted at Nginx Forum: > **[Some security vulnerable](https://forum.nginx.org/read.php?2,204051,204051#msg-204051)** > > What do you guys think about implement this into nginx just like it is in apache? if ( $fastcgi\_script\_name ~ \\..\*\\/.\*php ) { return 403; } because without that some servers which allows to upload images are vulnerable to external exploits. ---
**Author:** ![Kraiser](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/43a26b/32.png) [@Kraiser](https://www.ruby-forum.com/u/Kraiser)\ **Post date:** [June 5, 2011, 12:25pm UTC](https://www.ruby-forum.com/t/some-security-vulnerable/207885/2 "2011-06-05T12:25:34Z")
On Sun, Jun 5, 2011 at 5:01 PM, Kraiser [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > What do you guys think about implement this into nginx just like it is > in apache? > if ( $fastcgi\_script\_name ~ ..\*/.\*php ) { > return 403; > } > because without that some servers which allows to upload images are > vulnerable to external exploits. or just try\_files $uri =404; ---
**Author:** ![Kraiser](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/43a26b/32.png) [@Kraiser](https://www.ruby-forum.com/u/Kraiser)\ **Post date:** [June 5, 2011, 2:03pm UTC](https://www.ruby-forum.com/t/some-security-vulnerable/207885/3 "2011-06-05T14:03:46Z")
## Ensiferous Wrote: > Please elaborate on how allowing a filename like > .dsadsada/sad.php is insecure. Here is better explaintation of the issue : [http://forum.nginx.org/read.php?15,192150,192150](http://forum.nginx.org/read.php?15,192150,192150) Posted at Nginx Forum: [http://forum.nginx.org/read.php?2,204051,204068#msg-204068](http://forum.nginx.org/read.php?2,204051,204068#msg-204068) ---
**Author:** ![Kraiser](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/43a26b/32.png) [@Kraiser](https://www.ruby-forum.com/u/Kraiser)\ **Post date:** [June 5, 2011, 1:21pm UTC](https://www.ruby-forum.com/t/some-security-vulnerable/207885/4 "2011-06-05T13:21:07Z")
Please elaborate on how allowing a filename like .dsadsada/sad.php is insecure. Posted at Nginx Forum: > **[Re: Some security vulnerable](https://forum.nginx.org/read.php?2,204051,204064#msg-204064)** > > What do you guys think about implement this into nginx just like it is in apache? if ( $fastcgi\_script\_name ~ \\..\*\\/.\*php ) { return 403; } because without that some servers which allows to upload images are vulnerable to external exploits. ---
**Author:** ![Kraiser](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/43a26b/32.png) [@Kraiser](https://www.ruby-forum.com/u/Kraiser)\ **Post date:** [June 5, 2011, 3:40pm UTC](https://www.ruby-forum.com/t/some-security-vulnerable/207885/5 "2011-06-05T15:40:55Z")
On 5 June 2011 12:01, Kraiser [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > What do you guys think about implement this into nginx just like it is > in apache? > if ( $fastcgi\_script\_name ~ ..\*/.\*php ) { > return 403; > } > because without that some servers which allows to upload images are > vulnerable to external exploits. They’re vulnerable because of bad site design and configuration (although I do think nginx’s location parsing logic makes it uncomfortably easy to produce insecure configurations). Why not eliminate the vulnerability instead of hardening against it with more configuration? The .php match should not be attempted in any untrusted user-upload directory – use sub-locations. Thomas ---
**Author:** ![Kraiser](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/43a26b/32.png) [@Kraiser](https://www.ruby-forum.com/u/Kraiser)\ **Post date:** [June 5, 2011, 7:41pm UTC](https://www.ruby-forum.com/t/some-security-vulnerable/207885/6 "2011-06-05T19:41:21Z")
On 5 Jun 2011 14h40 WEST, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > eliminate the vulnerability instead of hardening against it with > more configuration? The .php match should not be attempted in any > untrusted user-upload directory – use sub-locations. I agree. Either nested locations and/or enumeration of all PHP enabled locations is the way to go. The above is just a stopgap for a proper meaning secure, configuration. — appa ---
**Author:** ![Kraiser](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/43a26b/32.png) [@Kraiser](https://www.ruby-forum.com/u/Kraiser)\ **Post date:** [June 5, 2011, 2:18pm UTC](https://www.ruby-forum.com/t/some-security-vulnerable/207885/7 "2011-06-05T14:18:36Z")
On Sun, Jun 5, 2011 at 7:03 PM, Kraiser [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > ## Ensiferous Wrote: > > > Please elaborate on how allowing a filename like > > .dsadsada/sad.php is insecure. > > Here is better explaintation of the issue : > [http://forum.nginx.org/read.php?15,192150,192150](http://forum.nginx.org/read.php?15,192150,192150) or this [http://forum.nginx.org/read.php?2,88845,88996](http://forum.nginx.org/read.php?2,88845,88996)