[Nginx] HTTP-Splitting vulnerability
Created by: anmol26s
Hi @beardyunixer @zotlabs @git-marijus Gixy is giving security issue in nginx.conf.
==================== Results ===================
>> Problem: [http_splitting] Possible HTTP-Splitting vulnerability.
Description: Using variables that can contain "\n" or "\r" may lead to http injection.
Additional info: https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md
Reason: At least variable "$uri" can contain "\n"
Pseudo config:
location / {
if ($is_args != ) {
rewrite ^/(.*) /index.php?q=$uri&$args last;
}
rewrite ^/(.*) /index.php?q=$uri last;
}
location ^~ /.well-known/ {
rewrite ^/(.*) /index.php?q=$uri&$args last;
}
I have replaced the $uri to $request_uri and now gixy is ok. Will this work? And I am wondering why gixy did not gave error for :
location ~* \.(jpg|jpeg|gif|png|ico|css|js|htm|html|map|ttf|woff|woff2|svg)$ {
expires 30d;
try_files $uri /index.php?q=$uri&$args;
}