快捷導(dǎo)航

Nginx修復(fù)CORS漏洞的實(shí)現(xiàn)方法

更新時(shí)間：2024年11月15日 11:55:10 作者：范一刀

本文主要介紹了CORS不安全配置漏洞的修復(fù)方法,通過修改Nginx配置,將Access-Control-Allow-Origin設(shè)置為正確的域名,以防止跨域資源共享時(shí)的隱私泄露風(fēng)險(xiǎn)

漏洞描述

CORS 不安全配置漏洞指的是在跨域資源共享過程中，由于資源服務(wù)器的響應(yīng)頭 Access-Control-Allow-Origin 配置不當(dāng)導(dǎo)致本應(yīng)該受限訪問的請求網(wǎng)站可以繞過訪問控制策略讀取資源服務(wù)器的數(shù)據(jù)，造成用戶隱私泄露，信息竊取甚至賬戶劫持的危害。

漏洞細(xì)節(jié)

經(jīng)過對以下目標(biāo)進(jìn)行掃描測試：https://xxx.com/external/

發(fā)現(xiàn)存在該漏洞。

發(fā)現(xiàn) Access-Control-Allow-Origin 的值為 https://xxx.com.qa5bnet.cn

漏洞探測過程的請求流為
第 1 個請求為

GET /external/ HTTP/1.1
Host: xxx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: en
Origin: https://xxx.com.qa5bnet.cn
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip

第 1 個響應(yīng)為

HTTP/1.1 401 
Access-Control-Allow-Methods: GET,POST,OPTIONS,PUT,DELETE
Access-Control-Allow-Origin: https://xxx.com.qa5bnet.cn
Connection: keep-alive
Content-Length: 0
Date: Mon, 13 Nov 2023 02:07:00 GMT
Www-Authenticate: BASIC realm="application"

漏洞修復(fù)

        set $flag 0;

        if ($http_origin = ''){
            set $flag "${flag}1";
        }

        if ($http_origin !~* ^(http|https)://test\.test\.com$){
            set $flag "${flag}1";
        }

        if ($flag = "01"){
            return 403;
        }

        if ($http_origin ~* ^(http|https)://test\.test\.com$) {
            add_header Access-Control-Allow-Origin $http_origin;
            add_header Access-Control-Allow-Methods GET,POST;
            add_header Access-Control-Allow-Credentials true;
            add_header Access-Control-Allow-Headers DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type;
}

具體配置如下：

  server {
        listen 80;
        server_name test.test.com;

        location / {
            set $flag 0;
    
            if ($http_origin = ''){
                set $flag "${flag}1";
            }
    
            if ($http_origin !~* ^(http|https)://test\.test\.com$){
                set $flag "${flag}1";
            }
    
            if ($flag = "01"){
                return 403;
            }
    
            if ($http_origin ~* ^(http|https)://test\.test\.com$) {
                add_header Access-Control-Allow-Origin $http_origin;
                add_header Access-Control-Allow-Methods GET,POST;
                add_header Access-Control-Allow-Credentials true;
                add_header Access-Control-Allow-Headers DNT,Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type;
    				}
        
            #將IP和端口改為DataEase服務(wù)器的訪問地址和端口
            proxy_pass   http://192.168.110.251:81/;
            server_name_in_redirect off;

            # websocket 代理
            proxy_http_version      1.1;
            proxy_set_header        Upgrade         $http_upgrade;
            proxy_set_header        Connection "upgrade";

            proxy_set_header           Host $host:$server_port;
            proxy_set_header           X-Real-IP $remote_addr;
            proxy_set_header           X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header           X-Forwarded-Proto $scheme;

           
        }
  }

到此這篇關(guān)于Nginx修復(fù)CORS漏洞的實(shí)現(xiàn)方法的文章就介紹到這了,更多相關(guān)Nginx修復(fù)CORS漏洞內(nèi)容請搜索腳本之家以前的文章或繼續(xù)瀏覽下面的相關(guān)文章希望大家以后多多支持腳本之家！

您可能感興趣的文章: