CVE-2023-45132

Summary

NAXSI is an open-source maintenance web application firewall (WAF) for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious X-Forwarded-For IP matches IgnoreIP IgnoreCIDR rules. This old code was arranged to allow older NGINX versions to also support IgnoreIP IgnoreCIDR when multiple reverse proxies were present. The issue is patched in version 1.6. As a workaround, do not set any IgnoreIP IgnoreCIDR for older versions.

Affected Software

Weaknesses

• CWE-693: CWE-693: Protection Mechanism Failure

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/wargio/naxsi/security/advisories/GHSA-7qjc-q4j9-pc8x
• https://github.com/wargio/naxsi/pull/103
• https://github.com/wargio/naxsi/commit/1b712526ed3314dd6be7e8b0259eabda63c19537

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://github.com/wargio/naxsi/security/advisories/GHSA-7qjc-q4j9-pc8x
• https://github.com/wargio/naxsi/pull/103
• https://github.com/wargio/naxsi/commit/1b712526ed3314dd6be7e8b0259eabda63c19537

• ←Previous
• Next→