Collected research
Hunting for Nginx Alias Traversals in the wild
An Nginx location prefix without a trailing slash combined with an alias directive that ends in one concatenates everything after the matched prefix onto the alias path, so a request to /img../ escapes the served directory. Code search across public repositories found it exposing Bitwarden's self-hosted vault database and Google HPC Toolkit's Django secret key and cloud credentials.
Record
- Researcher
- Daniel (Celesian) Matsumoto
- Published by
- Hakai Offensive Security
- Date
- Topic
- Other
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Daniel (Celesian) Matsumoto, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .