Nginx Security April 2022 NGINX zero-day vulnerability

rdan · Apr 14, 2022

More info
NGINX zero-day vulnerability: Check if you're affected

eva2000 · Apr 15, 2022

Interesting Addressing Security Weaknesses in the NGINX LDAP Reference Implementation - NGINX - looks like only impacts Nginx LDAP reference implementations which Centmin Mod Nginx doesn't use LDAP nor does it use LDAP reference implementation using Python daemon and related NGINX configuration at GitHub - nginxinc/nginx-ldap-auth: Example of LDAP authentication using ngx_http_auth_request_module.

On 9 April 2022, security vulnerabilities in the NGINX LDAP reference implementation were publicly shared. We have determined that only the reference implementation is affected. NGINX Open Source and NGINX Plus are not themselves affected, and no corrective action is necessary if you do not use the reference implementation.

The NGINX LDAP reference implementation uses Lightweight Directory Access Protocol (LDAP) to authenticate users of applications being proxied by NGINX. It is published as a Python daemon and related NGINX configuration at GitHub - nginxinc/nginx-ldap-auth: Example of LDAP authentication using ngx_http_auth_request_module, and its purpose and configuration are described in detail on our blog.

Deployments of the LDAP reference implementation are affected by the vulnerabilities if any of the following conditions apply. Below we further discuss the conditions and how to mitigate them:

Command-line parameters are used to configure the Python daemon

There are unused, optional configuration parameters

LDAP authentication depends on specific group membership

Note: The LDAP reference implementation is published as a reference implementation and describes the mechanics of how the integration works and all of the components required to verify the integration. It is not a production‑grade LDAP solution. For example, there is no encryption of the username and password used for the sample login page, and security notices call this out.
Click to expand...

The NGINX LDAP reference implementation uses LDAP to authenticate users of applications proxied by NGINX. The reference implementation was announced in June 2015. The solution leverages the ngx_http_auth_request_module (Auth Request) module in NGINX and NGINX Plus, which forwards authentication requests to an external service. In the reference implementation, that service is a daemon called ldap‑auth. It’s written in Python and communicates with a LDAP authentication server.
Click to expand...

Log in / Register

Forums

Welcome to Centmin Mod Community

Nginx Security April 2022 NGINX zero-day vulnerability

rdan Well-Known Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Welcome to Centmin Mod Community

Nginx Security April 2022 NGINX zero-day vulnerability

rdan Well-Known Member

eva2000 Administrator Staff Member

.