PT-2018-15227 · Nginx · Verynginx

Algtm · Published 2018-12-10 · Updated 2020-08-24 · CVE-2018-19991

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VeryNginx version 0.3.3

Description The issue allows remote attackers to bypass the Web Application Firewall feature due to the lack of an error handler for functions such as get uri args or get post args, which can lead to API misuse.

Recommendations For VeryNginx version 0.3.3, consider implementing a custom error handler to block potential API misuse until a patch is available. As a temporary workaround, review and restrict access to sensitive API endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2018-19991

Affected Products

Verynginx

References · 3

• 🔥 https://github.com/alexazhou/VeryNginx/issues/218 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-19991 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19991 · Vendor Advisory