Description
NGINX is a web server which can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.
The NGINX alias directive defines a replacement for the specified location.
For example, with the following configuration:
location /i/ {
alias /data/w3/images/;
}
on request of /i/top.gif, the file /data/w3/images/top.gif will be sent.
But, if the location doesn't ends with directory separator (i.e. /):
location /i {
alias /data/w3/images/;
}
on request of /i../app/config.py, the file /data/w3/app/config.py will be sent.
The incorrect configuration of the alias could allow an attacker to read file stored outside the target folder.
Remediation
Find all NGINX alias directives and make sure that the parent prefixed location ends with directory separator.
References
Related Vulnerabilities
WordPress Plugin Font-official webfonts plugin of Fonts For Web Directory Traversal (7.5)
WordPress Plugin WordPress File Upload Directory Traversal (4.12.2)
WordPress Plugin Page Flip Image Gallery 'book_id' Parameter Remote File Disclosure (0.2.2)
WordPress Plugin Download Shortcode Arbitrary File Disclosure (0.1)