CVE-2021-45918
📋 TL;DR
This vulnerability in NHI's health insurance web service allows remote attackers to cause a heap-based buffer overflow by sending overly long input strings. This can lead to service termination without authentication, requiring a system restart to recover. Organizations using NHI's health insurance web service component are affected.
💻 Affected Systems
- NHI Health Insurance Web Service Component
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption requiring system restart, potentially leading to extended downtime of health insurance services.
Likely Case
Service termination and denial of service affecting health insurance web service availability.
If Mitigated
Minimal impact with proper input validation and length restrictions in place.
🎯 Exploit Status
Attack requires sending specially crafted long input strings to vulnerable endpoints
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in available references
Vendor Advisory: https://www.twcert.org.tw/tw/cp-132-6227-eaf49-1.html
Restart Required: Yes
Instructions:
1. Contact NHI for specific patch information 2. Apply vendor-provided security updates 3. Restart affected services 4. Verify service functionality
🔧 Temporary Workarounds
Input Length Restriction
allImplement web application firewall or proxy rules to restrict input string length
# WAF rule example: Limit request body size
# nginx: client_max_body_size 1M;
# Apache: LimitRequestBody 1048576
Network Segmentation
linuxRestrict access to vulnerable service to trusted networks only
# Firewall rule example
iptables -A INPUT -p tcp --dport [service_port] -s [trusted_network] -j ACCEPT
iptables -A INPUT -p tcp --dport [service_port] -j DROP
🧯 If You Can't Patch
- Implement strict input validation at application layer to reject overly long strings
- Deploy web application firewall with buffer overflow protection rules
🔍 How to Verify
Check if Vulnerable:
Test by sending long input strings to service endpoints and monitoring for service disruptionCheck Version:
Contact vendor for version verification methodVerify Fix Applied:
Test with same long input strings after patch - service should remain operational📡 Detection & Monitoring
Log Indicators:
- Unusually long request strings in web logs
- Service restart events
- Out of memory errors
Network Indicators:
- Large HTTP POST/PUT requests to health insurance endpoints
- Multiple connection attempts with long payloads
SIEM Query:
source="web_logs" AND (uri="*health_insurance*" OR uri="*nhi*") AND request_length>10000