PT-2022-3849 · Nginx · Nginx Njs

Salmonxo · Published 2022-04-08 · Updated 2024-08-03 · CVE-2022-29379

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nginx NJS version 0.7.3

Description The issue is caused by a stack overflow in the njs default module loader function at /src/njs/src/njs module.c of the Nginx NJS interpreter. This could allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. Note that multiple third parties dispute this report, stating the behavior is only found in unreleased development code not part of the 0.7.2, 0.7.3, or 0.7.4 release.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

BDU:2022-04651

CVE-2022-29379

Affected Products

Nginx Njs

References · 10

• 🔥 https://github.com/nginx/njs/issues/493 · Exploit
• https://github.com/nginx/njs/commit/ab1702c7af9959366a5ddc4a75b4357d4e9ebdc1 · Patch
• https://bdu.fstec.ru/vul/2022-04651 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-29379 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29379 · Vendor Advisory
• https://github.com/nginx/njs/issues/491 · Note
• https://t.me/cvenotify/80150 · Telegram Post
• https://vuldb.com/ru/?id.200689 · Note
• https://t.me/cibsecurity/43328 · Telegram Post
• https://t.me/cvenotify/88717 · Telegram Post