6b59800 · searx · git.iko.soy

git.iko.soy/searx

Fix security vulnerabilities in suggested nginx configuration

The suggested configurations for nginx found in the documentation and templates lead to vulnerabilities allowing host spoofing [1] and path traversal [2], as reported by Gixy [3]. This commit fixes those issues. [1] https://github.com/yandex/gixy/blob/master/docs/en/plugins/hostspoofing.md [2] https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md [3] https://github.com/yandex/gixy

commit6b59800dc65fed855ecfdeb9fe40a37807ecfeb9 authorAlex Balgavy <alex@balgavy.eu> dateWed 3 Mar 2021, 12:21 (6 years ago) parentc748fc6

3 files changed+12−12

compare with master

unifiedsplit

docs/admin/filtron.rst+1−1 docs/admin/installation-nginx.rst+8−8 utils/templates/etc/nginx/default.apps-available/searx.conf:filtron+3−3

docs/admin/filtron.rst+1−1

@@ -173,7 +173,7 @@ Use it along with ``nginx`` with the following example configuration.

173173 location /searx {

174174 proxy_pass http://127.0.0.1:4004/;

175175

176− proxy_set_header Host $http_host;

176+ proxy_set_header Host $host;

177177 proxy_set_header Connection $http_connection;

178178 proxy_set_header X-Real-IP $remote_addr;

179179 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

docs/admin/installation-nginx.rst+8−8

@@ -182,7 +182,7 @@ Started wiki`_ is always a good resource *to keep in the pocket*.

182182 location /searx {

183183 proxy_pass http://127.0.0.1:4004/;

184184

185− proxy_set_header Host $http_host;

185+ proxy_set_header Host $host;

186186 proxy_set_header Connection $http_connection;

187187 proxy_set_header X-Real-IP $remote_addr;

188188 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

@@ -190,8 +190,8 @@ Started wiki`_ is always a good resource *to keep in the pocket*.

190190 proxy_set_header X-Script-Name /searx;

191191 }

192192

193− location /searx/static {

194− alias /usr/local/searx/searx-src/searx/static;

193+ location /searx/static/ {

194+ alias /usr/local/searx/searx-src/searx/static/;

195195 }

196196

197197

@@ -205,7 +205,7 @@ Started wiki`_ is always a good resource *to keep in the pocket*.

205205 location /morty {

206206 proxy_pass http://127.0.0.1:3000/;

207207

208− proxy_set_header Host $http_host;

208+ proxy_set_header Host $host;

209209 proxy_set_header Connection $http_connection;

210210 proxy_set_header X-Real-IP $remote_addr;

211211 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

@@ -309,8 +309,8 @@ Started wiki`_ is always a good resource *to keep in the pocket*.

309309 proxy_buffering off;

310310 }

311311

312− location /searx/static {

313− alias /usr/local/searx/searx-src/searx/static;

312+ location /searx/static/ {

313+ alias /usr/local/searx/searx-src/searx/static/;

314314 }

315315

316316 The ``X-Script-Name /searx`` is needed by the searx implementation to

@@ -328,8 +328,8 @@ Started wiki`_ is always a good resource *to keep in the pocket*.

328328 uwsgi_pass unix:/run/uwsgi/app/searx/socket;

329329 }

330330

331− location /searx/static {

332− alias /usr/local/searx/searx-src/searx;

331+ location /searx/static/ {

332+ alias /usr/local/searx/searx-src/searx/;

333333 }

334334

335335 For searx to work correctly the ``base_url`` must be set in the

utils/templates/etc/nginx/default.apps-available/searx.conf:filtron+3−3

@@ -3,7 +3,7 @@

33location ${SEARX_URL_PATH} {

44 proxy_pass http://127.0.0.1:4004/;

6− proxy_set_header Host \$http_host;

6+ proxy_set_header Host \$host;

77 proxy_set_header Connection \$http_connection;

88 proxy_set_header X-Real-IP \$remote_addr;

99 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;

@@ -11,6 +11,6 @@ location ${SEARX_URL_PATH} {

1111 proxy_set_header X-Script-Name ${SEARX_URL_PATH};

1212}

1313

14−location ${SEARX_URL_PATH}/static {

15− alias ${SEARX_SRC}/searx/static;

14+location ${SEARX_URL_PATH}/static/ {

15+ alias ${SEARX_SRC}/searx/static/;

1616}