PT-2023-6252 · Nginx+1 · Nginx+1

Lubomudr · Published 2023-10-11 · Updated 2023-10-18 · CVE-2023-45132

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions NAXSI versions 1.3 through 1.6

Description NAXSI is an open-source maintenance web application firewall (WAF) for NGINX. An issue allows someone to bypass the WAF when a malicious X-Forwarded-For IP matches IgnoreIP IgnoreCIDR rules. This old code was arranged to allow older NGINX versions to also support IgnoreIP IgnoreCIDR when multiple reverse proxies were present.

Recommendations For versions 1.3 through 1.5, as a temporary workaround, do not set any IgnoreIP IgnoreCIDR rules to minimize the risk of exploitation. For version 1.6, the issue is patched, so no additional action is required beyond ensuring this version is used. For all affected versions, consider updating to version 1.6 or later to fully resolve the issue.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

BDU:2023-06961

CVE-2023-45132

GHSA-7QJC-Q4J9-PC8X

Affected Products

Naxsi

Nginx

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45132.json · Exploit
• https://github.com/wargio/naxsi/pull/103 · Patch
• https://github.com/wargio/naxsi/commit/1b712526ed3314dd6be7e8b0259eabda63c19537 · Patch
• https://bdu.fstec.ru/vul/2023-06961 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45132 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45132 · Security Note
• https://github.com/wargio/naxsi · Note
• https://github.com/wargio/naxsi/security/advisories/GHSA-7qjc-q4j9-pc8x · Note
• https://vuldb.com/ru/?id.241992 · Note
• https://t.me/cvenotify/59651 · Telegram Post
• https://twitter.com/CVEnew/status/1712203335309099198 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1712236269281960249 · Twitter Post
• https://t.me/cibsecurity/72161 · Telegram Post
• https://t.me/latest_high_impact_cve/19 · Telegram Post