Avoiding Arbitrary Code Execution with nginx and php-fastcgi

This is another reason why it was a good idea to have my big application consist of only one public file which can easily be whitelisted. Everything else lives outside the web root and is never directly executed.

    location ~ ^/index\.php {
        proxy_pass   http://localhost:8080;
    }

Everything else in the web root is static files and can be served directly. The rest of the application uses an URL routing scheme based on PATH_INFO

Wow, am I glad I caught this link--I'm just now switching my servers from Apache to Nginx/php-fastcgi, configured more or less just like the article says...

I decided to switch to Nginx for the fabled performance benefits and relatively simple configuration. But this now makes me wonder what other gotchas there are in store for me... I have a long history with Apache, maybe I should just stick with it after all...

Was totally unaware of this issue in Nginx/PHP-FPM - going to check my conf files now!

UPDATE: Here's the thread on this issue right from NGINX.org http://forum.nginx.org/read.php?2,88845,page=3

In fact, this is well documented: http://wiki.nginx.org/Pitfalls#Passing_Every_.7E_.5C.php.24_...

For strong security (especially for frameworks like CodeIgniter):

location = /index.php { proxy_pass http://localhost:8080; }

It only runs exactly index.php in the root.

Does this same issue exist within Lighttpd with a FastCGI setup?

Is this PHP-FastCGI specific, or is PHP-FPM affected too?