Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Nginx Exploit

github.com

Post reply on HN
Print view View original

111–116 of 116 posts

Re: New Nginx Exploit

#111

Post by linkregister »

jcalvinowens wrote: post #110
linkregister wrote: post #87

Earlier quoted context omitted.

In your software, you set up a new heap for every pthread? I have never encountered this design pattern and would like to learn more.

If the workers weren't forked, the entire process would die to the SIGSEGV, and when it restarted the heap would be at a new address because of ASLR. This exploit couldn't work against a threaded daemon for that reason (only one guess). In a world where they are forked, having a randomized heap base in each worker would also defeat the brute force approach. Instead of just fork(), it could execve() itself with some a…

That's a reasonable solution.

Re: New Nginx Exploit

#112

Post by Fnoord »

MisterTea wrote: post #108
Fnoord wrote: post #102

Earlier quoted context omitted.

So the PoC works on MIPS out of the box. Tons of Linux/MIPS running around (Loongson64 seems to have KASLR on Linux).

Don't forget all the cheap WiFi routers with MT7688/MT7628/etc MIPS chips.

I was specifically thinking about the Edgerouter Lite running EdgeOS (Cavium SoC), but I also know some IP cameras do, and indeed some WAPs. For example, UniFi UAP-AC Lite and Pro variants. Each of these devices runs nginx for management (I suppose it could be disabled, each runs a variant of a SSH server as well). Worse, something like Shodan can find some of that on the internet.

Re: New Nginx Exploit

#113

Post by kevcampb »

kevcampb wrote: post #103

It seems that Snyk isn't picking this up on our docker images. They have a vulnerability published for the nginx binary itself. https://security.snyk.io/vuln/SNYK-UNMANAGED-NGINX-16679754 But they've not released any vulnerability for the Alpine or Debian packages. Does anyone know what's happening here? Seems concerning that there's a 2 day old RCE not being picked up.

They've just been released

https://security.snyk.io/vuln/SNYK-DEBIAN13-NGINX-16732761

https://security.snyk.io/vuln/SNYK-ALPINE323-NGINX-16722461

So it seems that Snyk is taking almost a week to get advisories out for an RCE

Re: New Nginx Exploit

#114

Post by account42 »

codedokode wrote: post #68
danslo wrote: post #10

This one's pretty bad but there are some preconditions. Requires a "rewrite" directive with a questionmark in the replacement string, and then a subsequent "set" directive that references a regex capture group (e.g. set $var $1). Also the POC assumes ASLR is disabled.

I think "rewrite" is rarely used nowadays? Isn't it something from old days of PHP and Apache?

We are talking about an nginx feature (which is commonly used btw), an Apache feature with a similar name and perhaps even vaguely similar functionality is not relevant.

Re: New Nginx Exploit

#115

Post by [deleted] »

jhatemyjob wrote: post #61
PaulDavisThe1st wrote: post #46

Earlier quoted context omitted.

We do this for 3 sub-domains of ardour.org; there's no application code involved, because we're rewriting historical URLs to their current form, and the "application" doesn't do that or need to do that or need to know about that.

Why not 302 instead?

[deleted]
Post reply on HN