Apache ignores access control when using FastCGI
56084 – Apache ignores access control when using FastCGI (mod_alias & mod_action)











      




With the following configuration: 
Apache <VirtualHost *:80>...
        <Files wp-login.php>
                Order Deny,Allow
                Deny from all
        </Files>
</VirtualHost>

The following file is not accessible:
http://127.0.0.1/wp-login.php
As a forbidden error message by Apache is returned.

If a user or attacker accesses the following URL, the access controls by Apache are completely ignored:
http://127.0.0.1/fcgi-php-fpm/wp-login.php
In the above case, wp-login.php is executed by PHP and a login screen is shown.

-----
In another scenario where directory-wide permissions are set to disable access, the following configuration is used:
<VirtualHost *:80>
        <Directory /var/www/>
          <Files *.php>
              SetHandler fcgi-php-fpm
          </Files>
                Order Deny,Allow
                Deny from all
        </Directory>               
</VirtualHost>
This configuration denies access to anyone trying to access the web server's document root.

The following URL:
http://127.0.0.1/somefile.php
Returns a forbidden error message by Apache.

However, the following URL renders:
http://127.0.0.1/fcgi-php-fpm/somefile.php

This all seem very strange, despite that PHP-FPM and Apache are 2 separate packages, services, applications, etc.


Please note the following configuration within Apache:
conf.d/php5-fpm:Action fcgi-php-fpm /fcgi-php-fpm virtual
conf.d/php5-fpm:Alias /fcgi-php-fpm /fcgi-php-fpm
conf.d/php5-fpm:FastCgiExternalServer /fcgi-php-fpm -socket /var/run/php5-fpm.sock -pass-header Authorization
sites-available/default:              SetHandler fcgi-php-fpm
sites-enabled/000-default:            SetHandler fcgi-php-fpm


Is it somehow possible to disable direct access to the Alias /fcgi-php-fpm ?


Note: This has been reported to PHP as well as it's unclear whether the bug is in Apache or PHP, despite that it looks like it's most likely an Apache bug.


The main problem is that you can bypass the access controls in place by Apache by prepending the Alias "/fcgi-php-fpm/" to a PHP file.
    

    

      
          Comment 1
        

        
          Eric Covener

        

        
        

        
          2014-01-29 02:01:01 UTC
        

      




Every request to /fcgi-php-fpm is mapped to something that doesn't exist on disk (by the Alias directive), so no <Directory> or <Files> configuration is applicable.

In other words, httpd is not mapping any of those PHP files to disk.  So from its perspective, there is no access control.

The fcgi script executes whatever you pass it (as PATH_INFO?), but most of the limiting in httpd that would limit URLs or PATH_INFO will apply the same to the original request as it does when mod_actions internally redirects it.

Can you log %{SCRIPT_FILENAME}e, %{PATH_TRANSLATED}e, and %{PATH_INFO}e for both cases?

append to httpd.conf:

  CustomLog logs/pr56084.log "%h %l %u %t \"%r\" %>s %b SF=%{SCRIPT_FILENAME}e PT=%{PATH_TRANSLATED}e PI=%{PATH_INFO}e"

Unfortunately even if these differ, they are not set until the handler is already running, so it would not be useful for core apache directives to act on.  But it might be useful for mod_fastcgi or php-fpm.
    

    

      
          Comment 2
        

        
          Hans

        

        
        

        
          2014-01-29 02:43:11 UTC
        

      




Hi Eric, thanks for the quick response.

Here's the information you requested.


Log entries when accessing the website in its default state: (i.e. like a normal user)
root@SC01:/etc/apache2/sites-available# tail -f /var/log/apache2/pr56084.log
59.167.247.251 - - [29/Jan/2014:13:38:09 +1100] "GET /sos/ HTTP/1.1" 200 5820 SF=/fcgi-php-fpm PT=/var/www/sos/index.php PI=/sos/index.php
59.167.247.251 - - [29/Jan/2014:13:38:10 +1100] "GET /sos/?mcsf_action=main_css HTTP/1.1" 200 355 SF=/fcgi-php-fpm PT=/var/www/sos/index.php PI=/sos/index.php
59.167.247.251 - - [29/Jan/2014:13:38:27 +1100] "GET /sos/about-us/ HTTP/1.1" 200 3968 SF=/fcgi-php-fpm PT=/var/www/sos/index.php PI=/sos/index.php
59.167.247.251 - - [29/Jan/2014:13:38:27 +1100] "GET /sos/?mcsf_action=main_css HTTP/1.1" 200 355 SF=/fcgi-php-fpm PT=/var/www/sos/index.php PI=/sos/index.php
59.167.247.251 - - [29/Jan/2014:13:38:29 +1100] "GET /sos/contact-details/ HTTP/1.1" 200 5149 SF=/fcgi-php-fpm PT=/var/www/sos/index.php PI=/sos/index.php
59.167.247.251 - - [29/Jan/2014:13:38:29 +1100] "GET /sos/?mcsf_action=main_css HTTP/1.1" 200 355 SF=/fcgi-php-fpm PT=/var/www/sos/index.php PI=/sos/index.php
59.167.247.251 - - [29/Jan/2014:13:38:30 +1100] "GET /sos/sitecontnt/themes/sos/i/formbg.jpg HTTP/1.1" 404 3751 SF=/fcgi-php-fpm PT=/var/www/sos/index.php PI=/sos/index.php
-----------------------------------------------------------------------

Log entries when prepending the "fcgi-php-fpm" alias string to requests:
root@SC01:/etc/apache2/sites-available# tail -f /var/log/apache2/pr56084.log
59.167.247.251 - - [29/Jan/2014:13:40:04 +1100] "GET /fcgi-php-fpm/sos/ HTTP/1.1" 404 3550 SF=/fcgi-php-fpm PT=/var/www/sos/index.php PI=/sos/
59.167.247.251 - - [29/Jan/2014:13:40:05 +1100] "GET /sos/?mcsf_action=main_css HTTP/1.1" 200 355 SF=/fcgi-php-fpm PT=/var/www/sos/index.php PI=/sos/index.php
59.167.247.251 - - [29/Jan/2014:13:40:10 +1100] "GET /fcgi-php-fpm/sos/index.php HTTP/1.1" 301 25 SF=/fcgi-php-fpm PT=/var/www/sos/index.php PI=/sos/index.php
59.167.247.251 - - [29/Jan/2014:13:40:10 +1100] "GET /fcgi-php-fpm/sos/ HTTP/1.1" 404 3550 SF=/fcgi-php-fpm PT=/var/www/sos/index.php PI=/sos/
59.167.247.251 - - [29/Jan/2014:13:40:10 +1100] "GET /sos/?mcsf_action=main_css HTTP/1.1" 200 355 SF=/fcgi-php-fpm PT=/var/www/sos/index.php PI=/sos/index.php
59.167.247.251 - - [29/Jan/2014:13:40:13 +1100] "GET /fcgi-php-fpm/sos/wp-login.php HTTP/1.1" 200 1451 SF=/fcgi-php-fpm PT=/var/www/sos/wp-login.php PI=/sos/wp-login.php
59.167.247.251 - - [29/Jan/2014:13:40:13 +1100] "GET /sos/?mcsf_action=main_css HTTP/1.1" 200 355 SF=/fcgi-php-fpm PT=/var/www/sos/index.php PI=/sos/index.php
59.167.247.251 - - [29/Jan/2014:13:40:35 +1100] "GET /fcgi-php-fpm/sos/wp-admin/ HTTP/1.1" 302 25 SF=/fcgi-php-fpm PT=/var/www/sos/wp-admin/index.php PI=/sos/wp-admin/
-----------------------------------------------------------------------
    

    

      
          Comment 3
        

        
          Hans

        

        
        

        
          2014-01-29 04:31:41 UTC
        

      




It's an Apache misconfiguration that's not pointed out very clearly.

The following is the fix:
        <Location /fcgi-php-fpm>
            # here we prevent direct access to this Location url,
            # env=REDIRECT_STATUS will let us use this fcgi-bin url
            # only after an internal redirect (by Action upper)
            Order Deny,Allow
            Deny from all
            Allow from env=REDIRECT_STATUS
        </Location>

It would be useful to point this out somewhere.

The above restricts direct access, but not internal access via PHP-FPM sockets.
    

    

      
          Comment 4
        

        
          trizk

        

        
        

        
          2014-01-29 13:16:58 UTC
        

      




You can also use rewrite rules to restrict access (eg.. to directories based on IP) to the proxied fastcgi service: 

RewriteEngine On
RewriteCond %{REQUEST_URI} ^[^\/]*/login/.*$ [NC]
RewriteCond %{REMOTE_HOST} !^(?:127\.0\.0\.1)|(?:1\.2\.3\.4)$
RewriteRule ^.*$   -   [NC,F]

Please note that these rules are context sensitive, relative to any proxy directives
    


  





  