CVE-2018-9230: SQL Injection
DISPUTED In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.geturiargs and ngx.req.getpostargs functions that ignore parameters beyond the hundredth one, which might allow remote attackers to bypass intended access restrictions or interfere with certain Web Application Firewall (ngxluawaf or X-WAF) products. NOTE: the vendor has reported that 100 parameters is an intentional default setting, but is adjustable within the API. The vendor's position is that a security-relevant misuse of the API by a WAF product is a vulnerability in the WAF product, not a vulnerability in OpenResty.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If your use case is sensitive to excessive query/form parameters and/or your WAF/controls depend on complete parameter parsing, adjust the ngx.req.get_uri_args and ngx.req.get_post_args argument limit (the vendor states the default is 100 parameters and it is adjustable within the API) to an appropriate value for your application.
OpenResty (ngx.req.get_uri_args / ngx.req.get_post_args) max_args (parameter limit within ngx.req.get_uri_args / ngx.req.get_post_args API) = Adjust from the intentional default of 100 as needed
Event History
Frequently Asked Questions
What is the vulnerability ID for this OpenResty vulnerability?
The vulnerability ID for this OpenResty vulnerability is CVE-2018-9230.
What is the severity of CVE-2018-9230?
The severity of CVE-2018-9230 is critical, with a severity value of 9.8.
How does CVE-2018-9230 affect OpenResty?
CVE-2018-9230 allows remote attackers to bypass access restrictions or interfere with certain Web Applications in OpenResty through 1.13.6.1 using URI parameters.
Why is CVE-2018-9230 considered a vulnerability?
CVE-2018-9230 is considered a vulnerability because it can lead to the bypassing of access restrictions or interference with Web Applications, compromising the security of OpenResty.
Is there a fix available for CVE-2018-9230?
Yes, a fix is available for CVE-2018-9230 in OpenResty version 1.13.7.2 and later.