Ngnix出现漏洞，可远程执行代码：Ngnix在遇到%00空字节时与后端FastCGI处理不一致，导致可以在图片中嵌入PHP代码后通过访问xxx.jpg%00.php来执行其中的代码。影响版本：0.5.*, 0.6.*, 0.7 <= 0.7.65, 0.8 <= 0.8.37。请各位同学检查服务器nginx版本，尽快升级！!
补救措施在上传目录增加如下配置。
# This location block will prevent an attacker from exploiting
# this vulnerability using files in the ‘uploads’ or ‘other_uploads’ directory
location ~ ^/(uploads|other_uploads)/.*.php$
{
deny all;
}
可以参见如下资料
https://nealpoole.com/blog/2011/07/possible-arbitrary-code-execution-with-null-bytes-php-and-old-versions-of-nginx/
转载请注明：爱开源 » Ngnix出现高危漏洞,记得防范