DigitalOcean的NGINX默认配置被突出显示为高风险

iq3niunx  于 2023-05-22  发布在  Nginx
关注(0)|答案(1)|浏览(188)

我有以下NGINX配置,默认情况下由DigitalOcean的NodeJS镜像创建。我已经修改了这个配置,但仍然是安全扫描工具,在这种情况下,我使用OWASP ZAP,仍然强调这是高风险。配置如下:

server {

    # SSL configuration
    ...
    root /var/www/mywebsite;

    # Add index.php to the list if you are using PHP
    index index.html index.htm index.nginx-debian.html;
    server_name mywebsite.com; # managed by Certbot

    location ^~ /assets/ {
        gzip_static on;
        expires 12h;
        add_header Cache-Control public;
    }

    location / {
        try_files $uri /index.html;     
    }
    
    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/mywebsite.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mywebsite.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    if ($host = mywebsite.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80 ;
    listen [::]:80 ;
    server_name mywebsite.com;
    return 404; # managed by Certbot

}

我的UI是从React构建的,所以我只是将构建工件放在/var/www/mywebsite中。
突出显示的风险如下:

Cloud Metadata Potentially Exposed
Solution:
Do not trust any user data in NGINX configs. In this case it is probably the use of the $host variable which is set from the 'Host' header and can be controlled by an attacker.
Reference:
https://www.nginx.com/blog/trust-no-one-perils-of-trusting-user-input/

它说了一些关于过度允许的代理是导致这一点,但我仍然不能弄清楚哪一部分,我需要改变。

vhmi4jdf

vhmi4jdf1#

Host标头可以被操纵,因此潜在的攻击者可以利用您正在使用$host变量来执行各种攻击。尝试更改配置的这一部分:

server {
    if ($host = mywebsite.com) {
        return 301 https://mywebsite.com$request_uri;
    } # managed by Certbot

相关问题