F5-K000161584: Buffer Overflow
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules. This vulnerability exists when the proxyhttpversion to 2 or grpcpass directives are used to proxy HTTP/2 traffic, the ignoreinvalidheaders directive is set to off, and the largeclientheaderbuffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 37.0.2.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 36 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.31.21.30.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.22.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.6.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.5.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires HTTP/2 traffic to be proxied using either proxy_http_version set to 2 or grpc_pass, with ignore_invalid_headers set to off and large_client_header_buffers larger than 2 megabytes. Deployments that do not meet all of these conditions are not described as affected.
Does exploitation require authentication or user interaction?
No. The described attacker is remote and unauthenticated, and no user interaction is required. Exploitation also depends on conditions beyond the attacker’s control.
What is the likely impact if the vulnerability is exploited?
Large headers can trigger a heap-based buffer overflow in an NGINX worker process, leading to a restart. Code execution is additionally possible where ASLR is disabled or where an attacker can bypass ASLR.
What configuration changes could reduce exposure if patching is not immediately possible?
Avoid the affected configuration combination where possible: do not proxy HTTP/2 using proxy_http_version set to 2 or grpc_pass while ignore_invalid_headers is off and large_client_header_buffers exceeds 2 megabytes. Reducing the large_client_header_buffers size to 2 megabytes or less, or not disabling invalid-header handling, removes stated prerequisites.