1

I want nginx to deny users who have folders inside /webroot/uploads

e.g.

/webroot/uploads/user1
/webroot/uploads/user2
/webroot/uploads/user999

to execute any shell (php, pl, py, binary).

The shells are often hidden in jpg or gif files. like badfile.php.jpg

I also see malacious binary files being uploaded to the folder.

Here my preliminary rules:

location ~ /webroot/uploads/(.+)\.php$ {
 deny all;
}

location ~ /webroot/uploads/(.+)\.pl$ {
 deny all;
}

But I am not sure it is robust enough. So I appreciate your help.

1

First of, make sure that you have the mime.types properly setup in your config file (http://wiki.nginx.org/FullExample#mime_types), so a foo.php.jpg is still treated as an image.

Also, use the tilde-asterisk (~*) instead of just the tilde (~), this will make your regex case insensitive (and thus prevent files like blah.pHP and evil.PHp, ...):

location ~* /webroot/uploads/(.+)\.php$ {
  deny all;
}

One approach you could take is to whitelist allowed extensions, and handle others. Since Nginx doesn't have a syntax for not matching an expression, you could "do nothing" when a match is found, and deny/redirect the rest

location ~* /webroot/uploads/(.+)\.(jpg|gif|png|mp3)$ {
  # empty block
}

# all other requests come here
location / {
  # redirect, deny, ...
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.