CVE-2021-46463
📋 TL;DR
CVE-2021-46463 is a critical type confusion vulnerability in njs (NGINX JavaScript) that allows attackers to hijack control flow and potentially execute arbitrary code. It affects NGINX servers using njs modules through version 0.7.1. Attackers could exploit this to compromise NGINX instances and potentially gain server access.
💻 Affected Systems
- NGINX with njs module
- NGINX Plus with njs module
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data theft, and lateral movement within the network.
Likely Case
Denial of service or limited code execution within the NGINX worker process context.
If Mitigated
Limited impact if NGINX runs with minimal privileges, proper sandboxing, and network segmentation.
🎯 Exploit Status
Exploitation requires sending crafted requests to NGINX endpoints using njs functionality. No public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: njs 0.7.2 and later
Vendor Advisory: https://github.com/nginx/njs/commit/6a40a85ff239497c6458c7dbef18f6a2736fe992
Restart Required: Yes
Instructions:
1. Update njs to version 0.7.2 or later. 2. Recompile NGINX with updated njs if using source build. 3. Restart NGINX service. 4. For NGINX Plus, update through official package repositories.
🔧 Temporary Workarounds
Disable njs module
linuxRemove or comment out njs module loading from NGINX configuration
# Edit nginx.conf and remove/comment: load_module modules/ngx_http_js_module.so;
# Then restart: systemctl restart nginx
🧯 If You Can't Patch
- Implement strict network access controls to limit NGINX exposure
- Run NGINX with minimal privileges and in isolated containers
🔍 How to Verify
Check if Vulnerable:
Check njs version: njs -v 2>&1 | head -1Check Version:
njs -vVerify Fix Applied:
Verify njs version is 0.7.2 or higher: njs -v📡 Detection & Monitoring
Log Indicators:
- Unusual NGINX worker process crashes
- Suspicious JavaScript execution errors in njs logs
Network Indicators:
- Unusual requests to endpoints using njs functionality
- Abnormal traffic patterns to NGINX
SIEM Query:
source="nginx_access.log" AND (status>=500 OR uri CONTAINS "js")🔗 References
- https://github.com/nginx/njs/commit/6a40a85ff239497c6458c7dbef18f6a2736fe992
- https://github.com/nginx/njs/issues/447
- https://security.netapp.com/advisory/ntap-20220303-0007/
- https://github.com/nginx/njs/commit/6a40a85ff239497c6458c7dbef18f6a2736fe992
- https://github.com/nginx/njs/issues/447
- https://security.netapp.com/advisory/ntap-20220303-0007/
