NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | HIGH |
| Attack Requirements | NONE |
| Privileges Required | NONE |
| User Interaction | NONE |
| Vulnerability Confidentiality | HIGH |
| Vulnerability Integrity | HIGH |
| Vulnerability Availability | HIGH |
| Subsequent Confidentiality | NONE |
| Subsequent Integrity | NONE |
| Subsequent Availability | NONE |
Source: [email protected]
Type: Secondary
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-122
|
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary |
en
CWE-131
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| f5 | dos | * | <built-in method update of dict object at 0x75d80224b9c0> | Application |
| f5 | dos | 4.8.0 | <built-in method update of dict object at 0x75d8039f3500> | Application |
| f5 | nginx_gateway_fabric | * | <built-in method update of dict object at 0x75d8039f3480> | Application |
| f5 | nginx_gateway_fabric | * | <built-in method update of dict object at 0x75d80224bec0> | Application |
| f5 | nginx_ingress_controller | * | <built-in method update of dict object at 0x75d802249540> | Application |
| f5 | nginx_ingress_controller | * | <built-in method update of dict object at 0x75d802249440> | Application |
| f5 | nginx_ingress_controller | * | <built-in method update of dict object at 0x75d8039f2680> | Application |
| f5 | nginx_instance_manager | * | <built-in method update of dict object at 0x75d8039f0740> | Application |
| f5 | nginx_open_source | * | <built-in method update of dict object at 0x75d8039f29c0> | Application |
| f5 | nginx_plus | * | <built-in method update of dict object at 0x75d80224b700> | Application |
| f5 | waf | * | <built-in method update of dict object at 0x75d828aadf40> | Application |
| f5 | waf | * | <built-in method update of dict object at 0x75d8039f0f80> | Application |
| f5 | waf | * | <built-in method update of dict object at 0x75d8039f0040> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:f5:dos:*:*:*:*:*:nginx:*:* |
| Yes | cpe:2.3:a:f5:dos:4.8.0:*:*:*:*:nginx:*:* |
| Yes | cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* |
| Yes | cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* |
| Yes | cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* |