nginx on Windows Directory Aliases Access Restriction Bypass

NASLDB: nginx on Windows Directory Aliases Access Restriction Bypass

General

ID: 61394
Name: nginx on Windows Directory Aliases Access Restriction Bypass

Summary: Checks version in Server response header

Credits: Tenable Network Security, Inc.

Classification

Risk: –

CVSS: –
CVSS Base Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Temporal Vector: –

Port: 80
Family: Web Servers
Type: Remote

Description

According to its Server response header, the installed version of
nginx is 0.x greater than or equal to 0.7.52 or 1.x earlier than 1.2.1
/ 1.3.1 and is, therefore, affected by an access restriction bypass
vulnerability.

By using a request with a specially crafted directory name, such as
‘/directory::$index_allocation’ in place of ‘/directory’, an attacker
may be able to bypass access restrictions such as :

location /directory/ {
deny all;
}

Note that this vulnerability only affects installs on Windows and that
Nessus has not tried to verify the underlying OS.