Nginx Code Execution due to Misconfiguration

Description

Misconfigurations in Nginx, particularly with PHP FPM (FastCGI Process Manager), can lead to a critical security vulnerability. Attackers can exploit this misconfiguration by appending /.php to the end of any file URL, allowing them to execute arbitrary PHP code on the server.

Recommendation

To mitigate this risk, modify your PHP FPM configurations in Nginx as follows:

  location ~ [^/]\.php$ {
    ...
  }

Ensure that the location directive includes [^/] before \.php to restrict access and prevent unauthorized execution of PHP scripts.

References

• Nginx PHP Configuration for Security
• Nginx
• CWE-16
• OWASP 2021-A5

Related Issues

• Nginx Null Byte Code Execution - CVE-2013-2028
• dom-iterator code execution vulnerability - CVE-2024-21541
• Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - flowise-components - CVE-2026-70477
• Flowise: Remote Code Execution Vulnerability in CSVAgent - CVE-2026-69256

You might also like:

Complete guide to HTTP Headers for securing websites (Cheat Sheet)

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Top Information Gathering Methods Explained

Tags:

Server Misconfiguration

Nginx

Arbitrary Code Execution

PHP FPM