nginx/nginx: The latest CVE Vulnerabilities and Exploits for Penetration Test

 

Page content

nginx/nginx Vulnerability Summary

  • Vendor name: nginx
  • Product name: nginx
  • Total vulnerabilities: 9 (as 2023-05-04)

nginx/nginx Vulnerability List

CVE-2019-20372: NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as…

Published: 2020-01-09T21:15:00 Last Modified: 2021-09-22T00:15:00

Summary

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

Common Weakness Enumeration (CWE): CWE-444: Inconsistent Interpretation of HTTP Requests (‘HTTP Request Smuggling’)

CWE Description: When malformed or abnormal HTTP requests are interpreted by one or more entities in the data flow between the user and the web server, such as a proxy or firewall, they can be interpreted inconsistently, allowing the attacker to “smuggle” a request to one device without the other device being aware of it.

Scores

  • Impact Score: 2.9
  • Exploitability Score: 8.6
  • CVSS: 4.3
  • CVSS Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Impact

  • Availability: NONE
  • Confidentiality: PARTIAL
  • Integrity: NONE

Access

  • Authentication: NONE
  • Complexity: MEDIUM
  • Vector: NETWORK

Currently, there is no code for exploiting the CVE-2019-20372 vulnerability.

References

See also: All popular products CVE Vulnerabilities of nginx

CVE-2019-9513: Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of…

Published: 2019-08-13T21:15:00 Last Modified: 2021-01-30T02:36:00

Summary

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.

Scores

  • Impact Score: 6.9
  • Exploitability Score: 10.0
  • CVSS: 7.8
  • CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Impact

  • Availability: COMPLETE
  • Confidentiality: NONE
  • Integrity: NONE

Access

  • Authentication: NONE
  • Complexity: LOW
  • Vector: NETWORK

Currently, there is no code for exploiting the CVE-2019-9513 vulnerability.

References

See also: All popular products CVE Vulnerabilities of nginx

CVE-2019-9516: Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of…

Published: 2019-08-13T21:15:00 Last Modified: 2021-01-30T02:36:00

Summary

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

Common Weakness Enumeration (CWE): CWE-770: Allocation of Resources Without Limits or Throttling

CWE Description: The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

Scores

  • Impact Score: 6.9
  • Exploitability Score: 8.0
  • CVSS: 6.8
  • CVSS Vector: AV:N/AC:L/Au:S/C:N/I:N/A:C

Impact

  • Availability: COMPLETE
  • Confidentiality: NONE
  • Integrity: NONE

Access

  • Authentication: SINGLE
  • Complexity: LOW
  • Vector: NETWORK

Currently, there is no code for exploiting the CVE-2019-9516 vulnerability.

References

See also: All popular products CVE Vulnerabilities of nginx

CVE-2019-9511: Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization…

Published: 2019-08-13T21:15:00 Last Modified: 2021-01-30T02:36:00

Summary

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Common Weakness Enumeration (CWE): CWE-770: Allocation of Resources Without Limits or Throttling

CWE Description: The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

Scores

  • Impact Score: 6.9
  • Exploitability Score: 10.0
  • CVSS: 7.8
  • CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Impact

  • Availability: COMPLETE
  • Confidentiality: NONE
  • Integrity: NONE

Access

  • Authentication: NONE
  • Complexity: LOW
  • Vector: NETWORK

Currently, there is no code for exploiting the CVE-2019-9511 vulnerability.

References

See also: All popular products CVE Vulnerabilities of nginx

CVE-2018-16844: nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that…

Published: 2018-11-07T14:29:00 Last Modified: 2021-12-16T19:01:00

Summary

nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the ‘http2’ option of the ’listen’ directive is used in a configuration file.

Common Weakness Enumeration (CWE): CWE-400: Uncontrolled Resource Consumption

CWE Description: The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Scores

  • Impact Score: 6.9
  • Exploitability Score: 10.0
  • CVSS: 7.8
  • CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Impact

  • Availability: COMPLETE
  • Confidentiality: NONE
  • Integrity: NONE

Access

  • Authentication: NONE
  • Complexity: LOW
  • Vector: NETWORK

Currently, there is no code for exploiting the CVE-2018-16844 vulnerability.

References

See also: All popular products CVE Vulnerabilities of nginx

CVE-2018-16845: nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might…

Published: 2018-11-07T14:29:00 Last Modified: 2021-12-16T19:01:00

Summary

nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file. Further, the attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module.

Common Weakness Enumeration (CWE): CWE-400: Uncontrolled Resource Consumption

CWE Description: The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Scores

  • Impact Score: 4.9
  • Exploitability Score: 8.6
  • CVSS: 5.8
  • CVSS Vector: AV:N/AC:M/Au:N/C:P/I:N/A:P

Impact

  • Availability: PARTIAL
  • Confidentiality: PARTIAL
  • Integrity: NONE

Access

  • Authentication: NONE
  • Complexity: MEDIUM
  • Vector: NETWORK

Currently, there is no code for exploiting the CVE-2018-16845 vulnerability.

References

See also: All popular products CVE Vulnerabilities of nginx

CVE-2018-16843: nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that…

Published: 2018-11-07T14:29:00 Last Modified: 2021-12-16T18:50:00

Summary

nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the ‘http2’ option of the ’listen’ directive is used in a configuration file.

Common Weakness Enumeration (CWE): CWE-400: Uncontrolled Resource Consumption

CWE Description: The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Scores

  • Impact Score: 6.9
  • Exploitability Score: 10.0
  • CVSS: 7.8
  • CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Impact

  • Availability: COMPLETE
  • Confidentiality: NONE
  • Integrity: NONE

Access

  • Authentication: NONE
  • Complexity: LOW
  • Vector: NETWORK

Currently, there is no code for exploiting the CVE-2018-16843 vulnerability.

References

See also: All popular products CVE Vulnerabilities of nginx

CVE-2009-3896: src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38,…

Published: 2009-11-24T17:30:00 Last Modified: 2021-11-10T15:52:00

Summary

src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI.

Common Weakness Enumeration (CWE): CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE Description: The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Scores

  • Impact Score: 2.9
  • Exploitability Score: 10.0
  • CVSS: 5.0
  • CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Impact

  • Availability: PARTIAL
  • Confidentiality: NONE
  • Integrity: NONE

Access

  • Authentication: NONE
  • Complexity: LOW
  • Vector: NETWORK

Currently, there is no code for exploiting the CVE-2009-3896 vulnerability.

References

See also: All popular products CVE Vulnerabilities of nginx

CVE-2009-3898: Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine…

Published: 2009-11-24T17:30:00 Last Modified: 2021-11-10T15:52:00

Summary

Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method.

Common Weakness Enumeration (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)

CWE Description: The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Scores

  • Impact Score: 4.9
  • Exploitability Score: 6.8
  • CVSS: 4.9
  • CVSS Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N

Impact

  • Availability: NONE
  • Confidentiality: PARTIAL
  • Integrity: PARTIAL

Access

  • Authentication: SINGLE
  • Complexity: MEDIUM
  • Vector: NETWORK

Exploits Database (Total Exploits Count: 1)

Code designed for conducting penetration testing on CVE-2009-3898 vulnerability.

References

See also: All popular products CVE Vulnerabilities of nginx