Skip to content

Fixed directory traversal vulnerability. #114

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Apr 2, 2019
Merged

Fixed directory traversal vulnerability. #114

merged 1 commit into from
Apr 2, 2019

Conversation

jlesage
Copy link
Contributor

@jlesage jlesage commented Apr 2, 2019

Management interface can leak local file system. For example, accessing an url like this is allowed:

http://test.com:81/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd

This PR fixes this by not allowing access to resources outside dist/.

@jc21
Copy link
Member

jc21 commented Apr 2, 2019

Docker Image for build 1 is available on DockerHub as jc21/nginx-proxy-manager:github-pr-114-amd64

@jlesage jlesage mentioned this pull request Apr 2, 2019
Closed
@jc21 jc21 merged commit e7ddcb9 into NginxProxyManager:master Apr 2, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@jlesage @jc21