HTTP Request Smuggling Vulnerability in libnginx-mod-http-lua and nginx Packages
Summary
DEBIAN-CVE-2024-33452: An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request. Affects libnginx-mod-http-lua versions < 1:0.10.27-1. Fixed in 1:0.10.27-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The libnginx-mod-http-lua and nginx packages are widely used components of the NGINX web server, which is known for its high performance, stability, rich feature set, and low resource consumption. These packages allow users to extend NGINX's capabilities using Lua scripts, enhancing its functionality for various web applications. However, a critical vulnerability has been identified in these packages, specifically in versions prior to 0.10.27 for libnginx-mod-http-lua and various versions for nginx, making them susceptible to HTTP request smuggling attacks.
Vulnerability Detail
An issue in OpenResty lua-nginx-module versions 0.10.26 and earlier allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request. This vulnerability can lead to unauthorized access to sensitive data, manipulation of web traffic, and potential exploitation of backend servers, posing significant security risks to affected systems.
How To Fix
Minimum fixed version
1:0.10.27-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libnginx-mod-http-luaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing strict input validation and sanitization for HTTP requests to mitigate the risk of HTTP request smuggling. Additionally, you may configure your web server to reject malformed requests.
Conclusion
The identified HTTP request smuggling vulnerability in the libnginx-mod-http-lua and nginx packages poses serious security risks. It is crucial for users to update their packages to the latest patched versions to mitigate these risks. Implementing workarounds can provide temporary relief, but timely updates are the best defense against potential exploitation.
See every vulnerability recorded for libnginx-mod-http-lua →
FAQ
HTTP request smuggling is a technique used by attackers to send malicious requests to a server, which can lead to unauthorized actions or data exposure.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The vulnerability can lead to unauthorized access to sensitive data, manipulation of web traffic, and exploitation of backend servers, posing significant security risks.
Yes, patched versions of the affected packages are available. Updating to libnginx-mod-http-lua version 1:0.10.27-1 and nginx version 1.22.0-3 will resolve the issue.
If immediate updates are not possible, implement strict input validation and consider rejecting malformed requests as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for libnginx-mod-http-lua.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
