F5-K000162416: Buffer Overflow
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when the $requestfilename variable is used in an access logformat directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 37.0.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.31.71.30.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.24.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.16.05.14.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.11.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.8.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.7.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure depends on configuration, not merely product presence. Affected deployments use a location that combines alias with rewrite and a set or return directive referencing $request_filename, or use $request_filename in an access log_format directive.
Does exploitation require authentication or user interaction?
No. The issue can be triggered by an unauthenticated attacker sending crafted HTTP requests, and it does not require user interaction.
What conditions affect exploitability?
Exploitation requires additional conditions beyond the attacker's control. Code execution is possible only where ASLR is disabled or the attacker can bypass ASLR.
What is the likely operational impact if an attack succeeds?
The crafted request can cause a heap buffer overflow in an NGINX worker process, leading to a worker restart. Under the stated ASLR conditions, the issue can also result in code execution.