HTTP Request Smuggling Vulnerability in NGINX: CVE-2019-20372
Summary
ALPINE-CVE-2019-20372: NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a l... Affects nginx versions < 1.16.1-r2. Fixed in 1.16.1-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NGINX is a high-performance web server and reverse proxy server known for its stability, rich feature set, and low resource consumption. It is widely used for serving static content, load balancing, and as a reverse proxy for various applications. However, certain configurations of the error_page directive in NGINX versions prior to 1.17.7 can lead to HTTP request smuggling vulnerabilities, allowing attackers to exploit the server's handling of requests.
Vulnerability Detail
The vulnerability, identified as CVE-2019-20372, arises from improper handling of HTTP requests when specific error_page configurations are used. This flaw can enable an attacker to perform HTTP request smuggling, potentially allowing unauthorized access to sensitive web pages when NGINX is deployed behind a load balancer. The ramifications include data leakage and unauthorized access to resources, which can compromise the integrity and confidentiality of the web application.
How To Fix
Minimum fixed version
1.16.1-r2
This is the first release that contains the fix.
sudo apk add --upgrade nginxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the specific error_page configurations that may lead to this vulnerability until the package can be updated. Review the NGINX configuration files and comment out or modify any error_page directives that could be exploited.
Conclusion
CVE-2019-20372 is a significant vulnerability affecting NGINX that can lead to HTTP request smuggling. It is crucial for users to update their NGINX installations to the patched versions to mitigate the risks associated with this vulnerability. Regular monitoring using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for nginx →
FAQ
CVE-2019-20372 is a vulnerability in NGINX that allows HTTP request smuggling due to improper handling of certain error_page configurations.
If you are using NGINX versions prior to 1.17.7, especially with specific error_page configurations, your installation may be vulnerable.
The vulnerability can lead to unauthorized access to sensitive web pages and data leakage, compromising the security of the web application.
You can update NGINX using the package manager for your operating system. For Alpine Linux, use 'apk add nginx=1.16.1-r6' for versions 3.11 and above.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
