Gixy

lastmod 2025-02-20created 2025-02-201 edits

NGINX configuration static analyzer

Nginx security configuration analysis tool

About

A tool that analyzes NGINX configuration to find security vulnerabilities
Aims to prevent security misconfigurations and detect vulnerabilities automatically
An active fork of the original Gixy made by Yandex (no commits for 2 years)

SSRF (Server Side Request Forgery): potential server-side request forgery attacks
HTTP Splitting: potential HTTP response splitting attacks
Referrer/Origin validation problems: security vulnerabilities caused by incomplete validation
add_header redefinition: problems with redefining response headers
Host header spoofing: potential forgery of the request's Host header
valid_referers misconfiguration: security problems caused by allowing the none value
Multiline response headers: security problems caused by response headers spanning multiple lines
Path traversal via alias misconfiguration: potential directory escape due to an incorrect alias setting
if statement problems: unexpected behavior from using if inside a location block
Allow misconfiguration: missing Deny setting when Allow is configured
Content-Type setting problems: issues when setting Content-Type with add_header
External DNS problems: insecure DNS configuration
Version information disclosure: version information exposed through the server_tokens setting
try_files setting problems: security problems when using try_files without open_file_cache
proxy_pass path decoding problems: URL paths being automatically decoded and normalized

By default, Gixy tries to analyze the NGINX configuration at /etc/nginx/nginx.conf
A specific path can also be given
- For example, it can find HTTP splitting vulnerabilities
Gixy can also read from a pipe (standard input)
Also available as a Docker image
- Mount the configuration to analyze as a volume and provide the configuration file path when running the Gixy image

author Zer0 sitemap