<story><title>Hunting for Nginx alias traversals in the wild</title><url>https://labs.hakaioffsec.com/nginx-alias-traversal/</url></story><parent_chain></parent_chain><comment><author>evgpbfhnr</author><text>FWIW gixy (nginx configuration checker) catches this:
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;yandex&amp;#x2F;gixy&amp;#x2F;blob&amp;#x2F;master&amp;#x2F;docs&amp;#x2F;en&amp;#x2F;plugins&amp;#x2F;aliastraversal.md&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;yandex&amp;#x2F;gixy&amp;#x2F;blob&amp;#x2F;master&amp;#x2F;docs&amp;#x2F;en&amp;#x2F;plugins&amp;#x2F;a...&lt;/a&gt;&lt;p&gt;(and nixos automatically runs gixy on a configuration generated through it, so the system refuses to build &amp;lt;3)</text></comment>
<story><title>Hunting for Nginx alias traversals in the wild</title><url>https://labs.hakaioffsec.com/nginx-alias-traversal/</url></story><parent_chain></parent_chain><comment><author>542458</author><text>At risk of asking a dumb question, is there any good reason that you’d &lt;i&gt;want&lt;/i&gt; nginx to allow traversing into “..” from a URL path? It just seems like problems waiting to happen.&lt;p&gt;Edit: Actually, I’m a bit lost as to what’s happening in the original vuln. &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;localhost&amp;#x2F;foo..&amp;#x2F;secretfile.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;http:&amp;#x2F;&amp;#x2F;localhost&amp;#x2F;foo..&amp;#x2F;secretfile.txt&lt;/a&gt; gets interpreted as &amp;#x2F;var&amp;#x2F;www&amp;#x2F;foo&amp;#x2F;..&amp;#x2F;secretfile.txt or whatever… but why wouldn’t a server without the vulnerability interpret &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;localhost&amp;#x2F;foo&amp;#x2F;..&amp;#x2F;secretfile.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;http:&amp;#x2F;&amp;#x2F;localhost&amp;#x2F;foo&amp;#x2F;..&amp;#x2F;secretfile.txt&lt;/a&gt; the same way? Why does “..” in paths only work &lt;i&gt;sometimes&lt;/i&gt;?</text></comment>