Top all-time · #3875
Neal Poole
Personal blog · nealpoole.com/blog · on HN as nbpoolesecurityprogramming
Neal Poole's personal blog at nealpoole.com covers security and programming. Since 2010, 20 different Hacker News readers have linked it 44 times, most often “Avoiding Arbitrary Code Execution with nginx and php-fastcgi”. The last post was in 2013, but the archive is still widely read.
Too few sampled comments (10) to say how often HN recommends it.?
Why HN links it
HN readers link Neal Poole's posts on web security and server setup, including PHP FastCGI configuration risks, XSS via a publicly accessible SWF file, and a 2010 Bitly-based file storage idea.
Summarised by Claude from a sample of 10 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
My name is Neal Poole. I'm interested in web application security.
Most-linked posts?
- Avoiding Arbitrary Code Execution with nginx and php-fastcgi6 people · 8 mentions · first linked 2011-04-08
- Bad Changes to eBay’s Responsible Disclosure Policy2 people · 2 mentions · first linked 2013-03-18
- Directory Traversal via PHP Multi-File Uploads2 people · 2 mentions · first linked 2011-10-03
- Cross-Site Scripting? In PHP Notices? It's more likely than you think2 people · 2 mentions · first linked 2011-08-18
- Security Vulnerabilities in Popular Flash Applets (SWFUpload, Plupload)2 people · 2 mentions · first linked 2012-05-17
- CSRF, Clickjacking, and the Role of X-Frame-Options2 people · 2 mentions · first linked 2012-03-31
- /blog/2010/12/bit-ly-file-storage-cleverness-and-chutzpah/2 people · 2 mentions · first linked 2015-06-05
What Hacker News says?
There was a bit of chatter recently about ill-configured nginx-fastcgi servers having a php vulnerability. Seems to be summed up here: https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-an... Thanks for the keep-alive tip. I missed that one. EDIT: I see that the author of the post I linked replied below- also with the link.
Comment linking /blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/
on “Nginx 1.0.0 is out”Submitted HTTP Response Splitting Vulnerability on reddit.com as a story · 80 points
HN discussionIf you do that, you have to be very careful. I actually did a writeup about this a few days ago that I posted on HN: https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-an... tl:dr is that the configuration you're suggesting will leave a site open to arbitrary code execution if the site allows for user uploads.
Comment linking /blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/
on “Nginx 1.0.0 is out”Submitted Avoiding Arbitrary Code Execution with nginx and php-fastcgi as a story · 61 points
HN discussionAlso in 2010 there was a file storage system based on Bitly: https://nealpoole.com/blog/2010/12/bit-ly-file-storage-cleve... Super clever idea, except for the part where Bitly now sprinkles links with affiliate codes to make $$$
Comment linking /blog/2010/12/bit-ly-file-storage-cleverness-and-chutzpah/
on “RedditStorage”Submitted Cross-Site Scripting? In PHP Notices? It's more likely than you think as a story · 43 points
HN discussionFrom 2010: https://nealpoole.com/blog/2010/12/bit-ly-file-storage-cleve...
Comment linking /blog/2010/12/bit-ly-file-storage-cleverness-and-chutzpah/
on “RedditStorage”Submitted Preventing CSRF Attacks with AJAX and HTTP Headers as a story · 39 points
HN discussionSome blogs I like (most are not updated very frequently, though): Billy Rios (discovered GIFAR) http://xs-sniper.com/blog/ Michal Zalewski (one of the top security researchers in the world, wrote "The Tangled Web", a must-read) http://lcamtuf.blogspot.com Neal Poole: https://nealpoole.com/blog/ Nir Goldshlager: http://www.nirgoldshlager.com/ Michael Brooks: https://sitewatch.me/en/Blog Nils Jünemann: http://www.nils…
Comment linking /blog/
on “How we hacked Facebook with OAuth2 and Chrome bugs”Submitted Hacking Google Calendar as a story · 25 points
HN discussionRead through https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-an...
Comment linking /blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/
on “Show HN: Initial release of H2O, and why HTTPD performance will matter in 2015”Submitted Reports from Google’s Vulnerability Reward Program as a story · 10 points
HN discussion>And it turns out to work incredibly well for the most part. It's serverless by design! Worked incredibly well compared to what? CGI was a performance nightmare, forking per request. CGI and FastCGI have both been a security nightmare. HTTPoxy, Shellshock, Pathinfo, and more. Setting up PHP correctly is cumbersome and depends on a complex interaction between sometimes confusing php.ini options and fairly complex con…
Comment linking /blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/
on “Goro – An implementation of PHP written in Go”Submitted Directory Traversal via PHP Multi-File Uploads as a story · 8 points
HN discussionAlso check for this dangerous configuration bug if you are using FastCGI and PHP (I'm not sure if this also applies to other FastCGI applications) https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-an...
Comment linking /blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/
on “Things I set on new servers”Submitted XSS Filters can be used to bypass clickjacking (scroll down to point 3) as a story · 8 points
HN discussionThat configuration contains a major security vulnerability, at least if your site allows file uploads (I tested it on my server to be sure). I've written about this issue before: https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-an... Edit: You need to copy the try_files line into the PHP location block. I'd recommend using the following line (I just added =403 to the end of yours, so you return a 403 error…
Comment linking /blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/
on “Show HN: This weird bug is probably present in your Nginx configuration.”Submitted Preventing CSRF Attacks with AJAX and HTTP Headers as a story · 6 points
HN discussion"This wouldn't happen if Yahoo had a Vulnerability Reward Program" As much as I support these kinds of programs ( https://nealpoole.com/blog/responsible-disclosure-programs/ ), that's a false dichotomy. Some companies have responsible disclosure policies or vulnerability reward programs. Some companies don't. Anecdotally, the companies that do have programs don't inherently respond more quickly or handle reports bet…
Comment linking /blog/2013/03/csrf-persistent-xss-in-my-ebay-com/
on “Yahoo, please start with a Vulnerability Reward Program”Submitted Arbitrary Code Execution with Null Bytes, PHP, and Old Versions of nginx as a story · 5 points
HN discussionDefinitely. Paying such a small amount, especially in credit that can only be redeemed in a company store, is patronizing and gets you mentioned in a negative light on Hacker News. If you don't pay, you're just like one of the many companies that doesn't have a bounty program. Edit: this reminds me of the "eBay goodies" offered to researcher Neal Poole in return for delaying disclosure of a vulnerability [ https://n…
Comment linking /blog/2013/03/bad-changes-to-ebays-responsible-disclosure-policy/
on “Security researchers rewarded $12.50 voucher to buy Yahoo T-shirt”Submitted Lessons from Facebook's Security Bug Bounty Program as a story · 3 points
HN discussionI was actually wondering not long ago if there might be some kind of cross-site scripting vulnerability implicit in rendering exceptions as html. Sure, you shouldn't have error reporting on to begin with but who even checks the source code of the exception pages themselves? You're paying close attention to the error itself after all... Turns out yes maybe... https://nealpoole.com/blog/2011/08/cross-site-scripting-vi…
Comment linking /blog/2011/08/cross-site-scripting-via-error-reporting-notices-in-php/
on “htmlspecialchars does not throw E_WARNING on multibyte problems”Submitted How Does Cross-Site Scripting Become Arbitrary Code Execution? as a story · 3 points
HN discussionYikes. Any site with a publicly accessible swfupload.swf is open to XSS. https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-appl...
Comment linking /blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/
on “Unpatched Wordpress Instance on Yahoo Blog Leads to Cookie Theft”Submitted XSS Filter Bypass in validator Node.js Module as a story · 2 points
HN discussionSubmitted CSRF Token Disclosure in Coinbase as a story · 2 points
HN discussionSubmitted How Hard Is It To Blacklist A Java Applet? as a story · 2 points
HN discussionSubmitted Security Vulnerabilities in Popular Flash Applets (SWFUpload, Plupload) as a story · 2 points
HN discussionSubmitted Java Deployment Toolkit Plugin Does Not Validate Installer Executable as a story · 2 points
HN discussion
