3

I understand that running apache/mod_php is safe, but I havn't heard about the case of running php in fastcgi mode (via nginx/php5-fpm), so, anyone can confirm this is also safe?

6

FastCGI communicates between the webserver and the CGI host using IPC rather than environment variables, so the main attack vector (the webserver setting environment variables for CGI) is gone. However, it is still possible for you to be attacked if your PHP script itself sets environment variables based on user input before executing bash.

  • 2
    +1 seems ok to me. downvoter care to comment? – user10008 Oct 7 '14 at 4:38
  • Is there any reference that points out fast CGI is safe ? – Jake Oct 16 '15 at 1:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.