# Urgent security issue in NGINX/php-fpm

**URL:** <https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665>\
**Category:** 📰 News\
**Created:** [October 24, 2019, 2:05pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665 "2019-10-24T14:05:56Z")\
**Posts on this page:** 20\
**Page:** 2

<div class="post-metadata">

**Author:** ![Schmu](https://help.nextcloud.com/user_avatar/help.nextcloud.com/schmu/32/7823_2.png) [@Schmu](https://help.nextcloud.com/u/Schmu)\
**Post date:** [October 25, 2019, 9:54am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/21 "2019-10-25T09:54:06Z")

</div>



---

<div class="post-metadata">

**Author:** ![Schmu](https://help.nextcloud.com/user_avatar/help.nextcloud.com/schmu/32/7823_2.png) [@Schmu](https://help.nextcloud.com/u/Schmu)\
**Post date:** [October 25, 2019, 9:55am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/22 "2019-10-25T09:55:29Z")

</div>

I corrected the article now regarding SCRIPTFILENAME vs. SCRIPT\_FILENAME and PATHINFO vs. PATH\_INFO. Also I pinned it globally.

---

<div class="post-metadata">

**Author:** ![Bernie\_O](https://help.nextcloud.com/user_avatar/help.nextcloud.com/bernie_o/32/40181_2.png) [@Bernie\_O](https://help.nextcloud.com/u/Bernie_O)\
**Post date:** [October 25, 2019, 10:00am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/23 "2019-10-25T10:00:10Z")

</div>

Oh - you can edit the first post? Could you please also add what Meiros posted?

> [@MeiRos](#):
>
> Here’s more updates since this news thread was opened.
> 
> [github.com/nextcloud/documentation](https://github.com/nextcloud/documentation/commit/95a2fb7baa6a7fef6bc9294db9df52cb3f49ff4f)
> 
> #### [fix PATH\_INFO](https://github.com/nextcloud/documentation/commit/95a2fb7baa6a7fef6bc9294db9df52cb3f49ff4f)
> 
> committed Yesterday 8:19 PM
> 
> [![jknockaert](https://avatars2.githubusercontent.com/u/7431682?v=4) jknockaert ](https://github.com/jknockaert)
> 
> [+4 -2](https://github.com/nextcloud/documentation/commit/95a2fb7baa6a7fef6bc9294db9df52cb3f49ff4f/files)
> 
> `try_files` was added in #1674, but that resets `$fastcgi_path_info`. This PR makes sure PATH\_INFO gets the original value.

The was another change in the nginx-config, which didn‘t make it in the initial post. It would be great, if you could add that as well, since many people might not notice the other change.

---

<div class="post-metadata">

**Author:** ![Schmu](https://help.nextcloud.com/user_avatar/help.nextcloud.com/schmu/32/7823_2.png) [@Schmu](https://help.nextcloud.com/u/Schmu)\
**Post date:** [October 25, 2019, 10:10am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/24 "2019-10-25T10:10:29Z")

</div>

I actually didn’t want to mess with the official post, but I think you are right. If users already modify their config, it should be done right.

So @all please, check your config again, there has been a little change in the first post!

---

<div class="post-metadata">

**Author:** ![Gee858eeG](https://help.nextcloud.com/user_avatar/help.nextcloud.com/gee858eeg/32/15746_2.png) [@Gee858eeG](https://help.nextcloud.com/u/Gee858eeG)\
**Post date:** [October 25, 2019, 10:54am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/25 "2019-10-25T10:54:12Z")

</div>

> [@system](#):
>
> Note the addition of the **`$try_files $fastcgi_script_name =404;`**

i see two added lines:

```auto
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;

```

Edit: Oh, Bernie\_O already mentioned that in the post above. My bad

---

<div class="post-metadata">

**Author:** ![DecaTec](https://help.nextcloud.com/user_avatar/help.nextcloud.com/decatec/32/76_2.png) [@DecaTec](https://help.nextcloud.com/u/DecaTec)\
**Post date:** [October 25, 2019, 11:04am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/26 "2019-10-25T11:04:22Z")

</div>

@Schmu Please also update the official blog post. Having two different versions might be a bit confusing.  
@jospoortvliet

---

<div class="post-metadata">

**Author:** ![Schmu](https://help.nextcloud.com/user_avatar/help.nextcloud.com/schmu/32/7823_2.png) [@Schmu](https://help.nextcloud.com/u/Schmu)\
**Post date:** [October 25, 2019, 11:27am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/27 "2019-10-25T11:27:05Z")

</div>

@DecaTec

Sorry, I’m not an official and don’t have access to the blog.  
I only jumped in to help forum users to directly pick the latest config changes. We have to wait for @system to do so.

---

<div class="post-metadata">

**Author:** ![lug-gh](https://help.nextcloud.com/user_avatar/help.nextcloud.com/lug-gh/32/8679_2.png) [@lug-gh](https://help.nextcloud.com/u/lug-gh)\
**Post date:** [October 25, 2019, 12:36pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/28 "2019-10-25T12:36:34Z")

</div>

Please remove the typo ^^

**`$try_files`**  
-\>  
**`try_files`**

---

<div class="post-metadata">

**Author:** ![Seferi](https://help.nextcloud.com/user_avatar/help.nextcloud.com/seferi/32/22552_2.png) [@Seferi](https://help.nextcloud.com/u/Seferi)\
**Post date:** [October 25, 2019, 1:13pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/29 "2019-10-25T13:13:46Z")

</div>

I’m running Nginx on a raspberry pi as a reverse proxy. And on another raspberry pi NextcloudPi. Would it effect me as well?

Asking because i don’t even have ’ rewrite ^ /index.php$request\_uri ’ under location…

---

<div class="post-metadata">

**Author:** ![Chappie](https://help.nextcloud.com/letter_avatar/chappie/32/6_22734026db12803ebb3e059622ac3534.png) [@Chappie](https://help.nextcloud.com/u/Chappie)\
**Post date:** [October 25, 2019, 2:44pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/30 "2019-10-25T14:44:39Z")

</div>

same here, do i need to update the php version running nextcloud on snap? if yes then how do i do that?

---

<div class="post-metadata">

**Author:** ![Bernie\_O](https://help.nextcloud.com/user_avatar/help.nextcloud.com/bernie_o/32/40181_2.png) [@Bernie\_O](https://help.nextcloud.com/u/Bernie_O)\
**Post date:** [October 25, 2019, 4:00pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/31 "2019-10-25T16:00:42Z")

</div>

> [@Chappie](#):
>
> do i need to update the php version running nextcloud on snap?

no

> [@Urgent security issue in NGINX/php-fpm](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/15):
>
> Nextcloud-Snap comes with Apache and not with nginx, so you should be safe: [https://github.com/nextcloud/nextcloud-snap#snappy-nextcloud](https://github.com/nextcloud/nextcloud-snap#snappy-nextcloud)

---

<div class="post-metadata">

**Author:** ![nolsen](https://help.nextcloud.com/letter_avatar/nolsen/32/6_22734026db12803ebb3e059622ac3534.png) [@nolsen](https://help.nextcloud.com/u/nolsen)\
**Post date:** [October 25, 2019, 5:58pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/32 "2019-10-25T17:58:58Z")

</div>

Updated nginx to mainline, php to 7.3, and nextcloud to 17. Running on Ubuntu 19.10, and I added the nginx hardened config…

I got a whitescreen of death now, cannot access nextcloud.

---

<div class="post-metadata">

**Author:** ![rex](https://help.nextcloud.com/user_avatar/help.nextcloud.com/rex/32/17385_2.png) [@rex](https://help.nextcloud.com/u/rex)\
**Post date:** [October 25, 2019, 6:03pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/34 "2019-10-25T18:03:00Z")

</div>

Is it related to this?

> [@Urgent security issue in NGINX/php-fpm](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/17):
>
> WARNING to everybody with nginx version: nginx/1.10.3 (Debian stretch latest) The directive or cgi\_parameter SCRIPTFILENAME will render your nextcloud website blank. change it to SCRIPT\_FILENAME

---

<div class="post-metadata">

**Author:** ![nolsen](https://help.nextcloud.com/letter_avatar/nolsen/32/6_22734026db12803ebb3e059622ac3534.png) [@nolsen](https://help.nextcloud.com/u/nolsen)\
**Post date:** [October 25, 2019, 6:04pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/35 "2019-10-25T18:04:20Z")

</div>

Yep, that warning is real.

White screen went away, it seems OP needs to be updated.

---

<div class="post-metadata">

**Author:** ![MeiRos](https://help.nextcloud.com/user_avatar/help.nextcloud.com/meiros/32/8211_2.png) [@MeiRos](https://help.nextcloud.com/u/MeiRos)\
**Post date:** [October 25, 2019, 7:08pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/36 "2019-10-25T19:08:07Z")

</div>

There’s one new line in the docs, which is not included in the op.

```auto
location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
    fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
    set $path_info $fastcgi_path_info;
    try_files $fastcgi_script_name =404;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_param PATH_INFO $path_info;
    fastcgi_param HTTPS on;
    # Avoid sending the security headers twice
    fastcgi_param modHeadersAvailable true;
    # Enable pretty urls
    fastcgi_param front_controller_active true;
    fastcgi_pass php-handler;
    fastcgi_intercept_errors on;
    fastcgi_request_buffering off;
}

```

Added **set $path\_info $fastcgi\_path\_info;**

If you edited or will edit, it’s good to look the example in the docs.

---

<div class="post-metadata">

**Author:** ![e-raser](https://help.nextcloud.com/user_avatar/help.nextcloud.com/e-raser/32/7563_2.png) [@e-raser](https://help.nextcloud.com/u/e-raser)\
**Post date:** [October 25, 2019, 7:28pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/37 "2019-10-25T19:28:53Z")

</div>

Dumb question:

I don´t have

```auto
location / {
                rewrite ^ /index.php$request_uri;
            }

```

But I have

```auto
location / {
  try_files $uri $uri/ index.php;
}

```

Is this part doing the same stuff, just with other words? If I just add the

```auto
 location / {
                rewrite ^ /index.php;
            }

```

section the “nginx configtest” fails. PHP by the way not updated yet cause latest Raspbian sources are not containing it yet ☹

---

<div class="post-metadata">

**Author:** ![alex\_rhys-hurn](https://help.nextcloud.com/letter_avatar/alex_rhys-hurn/32/6_22734026db12803ebb3e059622ac3534.png) [@alex\_rhys-hurn](https://help.nextcloud.com/u/alex_rhys-hurn)\
**Post date:** [October 25, 2019, 11:39pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/38 "2019-10-25T23:39:36Z")

</div>

Similar to you I have:

```
location / {
rewrite ^ /index.php$uri;
}

```

Do I need to change this?

---

<div class="post-metadata">

**Author:** ![BeWog](https://help.nextcloud.com/user_avatar/help.nextcloud.com/bewog/32/25791_2.png) [@BeWog](https://help.nextcloud.com/u/BeWog)\
**Post date:** [October 26, 2019, 7:53am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/39 "2019-10-26T07:53:45Z")

</div>

> [@lug-gh](#):
>
> try\_files

Thank you, i had this error:

```
$ sudo nginx -t
nginx: [emerg] unknown directive "$try_files" in /etc/nginx/conf.d/nextcloud.conf:107
nginx: configuration file /etc/nginx/nginx.conf test failed

```

---

<div class="post-metadata">

**Author:** ![Tahvok](https://help.nextcloud.com/user_avatar/help.nextcloud.com/tahvok/32/21190_2.png) [@Tahvok](https://help.nextcloud.com/u/Tahvok)\
**Post date:** [October 26, 2019, 8:30am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/40 "2019-10-26T08:30:56Z")

</div>

For others searching for the correct (and updated) documentation:  
[https://docs.nextcloud.com/server/17/admin\_manual/installation/nginx.html](https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html)

The examples under docker repo are still not updated. So use the documentation to update the nginx configs.

---

<div class="post-metadata">

**Author:** ![Tahvok](https://help.nextcloud.com/user_avatar/help.nextcloud.com/tahvok/32/21190_2.png) [@Tahvok](https://help.nextcloud.com/u/Tahvok)\
**Post date:** [October 26, 2019, 10:24am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/41 "2019-10-26T10:24:34Z")

</div>

For those working with nginx as reverse proxy to a docker container, or any other configuration where local files at nginx proxy do not match to path at fastcgi server.  
You would need to edit SCRIPT\_FILENAME to match against the path inside the fastcgi server. An example in case of the official fpm docker container:  
fastcgi\_param SCRIPT\_FILENAME /var/www/html$fastcgi\_script\_name;

[Previous page](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665.md?page=1)

[Next page](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665.md?page=3)