REDHAT-BUG-2500960: Medium severity F5 NGINX Plus vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes (SSI), proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a heap buffer over-read in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.
Impact: This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If you have ngx_http_ssi_module enabled and also configure Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives, mitigate by removing/changing that configuration to ensure the vulnerability condition is not met (e.g., do not use proxy_buffering off with the affected SSI/proxy_pass setup).
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Review NGINX Plus and NGINX Open Source deployments that use ngx_http_ssi_module with SSI enabled, proxy_pass configured, and proxy_buffering disabled. The issue is described as affecting the data plane only, not the control plane.
What attacker access is required for exploitation?
An unauthenticated attacker must have man-in-the-middle capability to control responses from an upstream server. The provided information does not describe exploitation solely through direct requests to NGINX.
Is a default NGINX configuration known to be affected?
The affected condition requires the combination of SSI, proxy_pass, and proxy_buffering off directives. The provided information does not state whether that combination is present in any default configuration.