Discussion
🚨 Hey, so that nginx RCE targeting instances with the unnamed rewrite rule? => It's extremely common.
That exact rule is the official recommended config from Yoast for their XML sitemaps on NGINX.
From their help page:
rewrite ^/([^/]+?)-sitemap([0-9]+)?.xml$ /index.php?sitemap=$1&sitemap_n=$2 last;
This is copy-pasted verbatim by millions of WP sites running Yoast SEO (5+ million active installs) and also by sites using other SEO plugins that followed Yoast's lead. (1/3)
The EasyEngine tutorial, StackPointer, WPMU DEV, Stack Overflow, and the WordPress.org forums all reference this same pattern.
This can easily be chained with one (or both) of two recent and trivial-to-exploit local privilege escalation Linux vulns.
In the words of @krypt3ia :
we doomed.
HOWEVER: I threw together a small Bash script that tries to detect whether a given conf file or directory of nginx configs has vulnerable directives. You can find it at:
Install bonfire.cafe
Get the full app experience
