PT-2018-18916 · Openresty · Openresty

Published 2018-04-02 · Updated 2024-08-05 · CVE-2018-9230

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenResty versions 1.13.6.1 and earlier

Description The issue arises from how OpenResty obtains URI parameters using the ngx.req.get uri args and ngx.req.get post args functions, which ignore parameters beyond the hundredth one. This might allow remote attackers to bypass intended access restrictions or interfere with certain Web Application Firewall products, such as ngx lua waf or X-WAF. However, the vendor considers this a default setting that is adjustable within the API and views any security-relevant misuse of the API by a WAF product as a vulnerability in the WAF product, not in OpenResty.

Recommendations For OpenResty versions 1.13.6.1 and earlier, consider adjusting the parameter limit within the API to prevent potential bypass of access restrictions. As a temporary workaround, restrict the use of the ngx.req.get uri args and ngx.req.get post args functions to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-9230

Affected Products

Openresty

References · 5

• 🔥 https://github.com/Bypass007/vuln/blob/master/OpenResty/Uri%20parameter%20overflow%20in%20Openresty.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-9230 · Security Note
• https://openresty.org/en/changelog-1013006.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-9230 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9230 · Note