Topics of Interest: Common NGINX Misconfigurations That Leave Your Web Server Open ...

### Overview In this talk, Spencer, a security researcher at Detectify based in Stockholm, discusses common NGINX misconfigurations that leave web servers vulnerable to attack. Detectify operates an automated web vulnerability scanner using crowdsourced research from white-hat hackers worldwide, converting proofs-of-concept into continuously running modules. Spencer outlines how his team analyzed approximately 50,000 NGINX configuration files gathered from public GitHub repositories using Google BigQuery and command-line pattern matching tools to discover widespread real-world misconfigurations.

### Key Topics - **Research Methodology**: Querying public GitHub datasets on Google BigQuery for repositories containing `nginx.conf` files, constructing raw download URLs using repository details, and parsing files with shell tools to locate pattern-based flaws. - **Missing Root Directive**: The risks associated with declaring a global `root` directive without restricting it to specific location blocks. - **Off-by-Slash Misconfiguration**: Directory traversal risks caused by omitting trailing slashes in alias configurations. - **CRLF Injection via the `$uri` Variable**: Header injection and response body tampering enabled by automatic URL decoding in NGINX's `$uri` variable. - **Proxy Pass with Regular Expressions**: HTTP request splitting and host header injection when regex matching allows newline characters into proxy requests.

### Technical Details - **Missing Root Directive**: If a root directive is specified globally (e.g., set to `/etc/nginx`) without an explicit root location block, any unhandled request will default to serving files from that folder. Requesting `/test` or `/nginx.conf` allows attackers to retrieve sensitive files such as configuration files, access logs, or HTTP basic authentication credentials. The fix is setting specific, restricted paths for root directives without exposing sensitive directories. - **Off-by-Slash (Alias Traversal)**: The `alias` directive replaces a matched path prefix. If a location prefix (e.g., `/static` or `/api`) lacks a trailing directory separator (`/`), appending a relative traversal like `..` in the request causes NGINX to map to a parent directory (e.g., traversing one folder above the intended path). In a demonstration on a sample application, this technique allowed reading a `secret.html` file stored alongside the target picture directory. The fix is ensuring trailing slashes match on both the location path and the alias target. - **CRLF Injection via `$uri`**: The built-in NGINX `$uri` variable automatically decodes URL-encoded values, including carriage return (`%0D`) and line feed (`%0A`) characters. If `$uri` is used in a redirect or header reflection, attackers can inject custom HTTP headers or inject double CRLF sequences to supply an arbitrary HTTP response body. This enables cross-site scripting (XSS) and cookie leakage. The remediation is replacing `$uri` with `$request_uri`, which retains raw, unprocessed URI values without decoding. - **Proxy Pass via Regex**: When `proxy_pass` uses regular expressions to capture paths and proxy upstream (e.g., to an Amazon S3 bucket), expressions that inadvertently match newline characters enable CRLF injection into upstream HTTP requests. Attackers can inject a custom `Host` header pointing to an attacker-controlled S3 bucket serving malicious JavaScript. This creates risks for web cache poisoning, XSS, and server-side request forgery (SSRF). The remediation is utilizing strict regex patterns that disallow newlines in proxy-passed inputs.

### Takeaways NGINX powers roughly one-third of websites due to its speed, modularity, and load-balancing capabilities, but slight syntax oversights can cause severe vulnerabilities. Administrators should avoid global sensitive root paths, ensure symmetrical directory slashes when defining aliases, favor `$request_uri` over `$uri` in redirects, and sanitize regex inputs forwarded to upstream proxy servers.