Nginx server bugs could lead to RCE

guest · Jun 3, 2019

Nginx server bugs could lead to RCE
June 3, 2019
https://portswigger.net/daily-swig/nginx-server-bugs-could-lead-to-rce

Two bugs discovered in Nginx web servers could be exploited to achieve remote code execution (RCE), a security researcher has warned.
The vulnerabilities in question – described as an array overflow and an integer overflow – were reported by Alisa Esage via Trend Micro’s Zero Day Initiative (ZDI) disclosure platform.

The array overflow vulnerability (ZDI-CAN-8296) was patched in the 0.3.2 release.
In accordance with ZDI’s responsible disclosure policy, no further details have been released about the integer overflow vulnerability, although Nginx is understood to be working on a fix.

Esage warns that the integer overflow bug (ZDI-CAN-8495) and the already-patched vulnerability could lead to RCE – a particular concern given that more than 40% of websites globally are estimated to use Nginx.

“Both Array and String methods of njs are potentially reachable with remote user input (http request data, etc.), as it’s mapped to a global JavaScript object available for parsing,” the researcher wrote on Twitter.
Click to expand...

Log in or Sign up

Nginx server bugs could lead to RCE

guest Guest

Log in or Sign up

Nginx server bugs could lead to RCE

guest Guest

Useful Searches