CVE-2022-29369
📋 TL;DR
CVE-2022-29369 is a segmentation fault vulnerability in Nginx NJS (JavaScript engine) that can cause denial of service or potentially allow arbitrary code execution. It affects systems running Nginx with NJS module enabled. Attackers could crash the Nginx process or exploit memory corruption.
💻 Affected Systems
- Nginx NJS (JavaScript engine for Nginx)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or lateral movement within the network.
Likely Case
Denial of service through Nginx process crashes, disrupting web services and availability.
If Mitigated
Limited impact with proper segmentation and minimal NJS usage, potentially just service restarts.
🎯 Exploit Status
The vulnerability is in njs_lvlhsh_bucket_find function, which can be triggered via crafted JavaScript in NJS contexts. Proof-of-concept details are available in the GitHub issue.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: NJS version 0.7.3 or later
Vendor Advisory: https://github.com/nginx/njs/commit/222d6fdcf0c6485ec8e175f3a7b70d650c234b4e
Restart Required: Yes
Instructions:
1. Update NJS to version 0.7.3 or later. 2. Recompile Nginx with the updated NJS module if using source builds. 3. Restart Nginx service to apply changes.
🔧 Temporary Workarounds
Disable NJS Module
linuxTemporarily disable the NJS module in Nginx configuration if not required for functionality.
# Edit Nginx config file (e.g., /etc/nginx/nginx.conf)
# Remove or comment out 'js_include' and 'js_set' directives
# Reload Nginx: sudo nginx -s reload
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable Nginx instances from critical systems.
- Use web application firewalls (WAF) to filter malicious requests targeting NJS functionality.
🔍 How to Verify
Check if Vulnerable:
Check NJS version: njs -v or grep for NJS version in Nginx build output. If version is 0.7.2, it is vulnerable.Check Version:
njs -v 2>/dev/null || nginx -V 2>&1 | grep njsVerify Fix Applied:
After patching, verify NJS version is 0.7.3 or later using njs -v command.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in Nginx error logs
- Unexpected Nginx process crashes or restarts
Network Indicators:
- HTTP requests containing JavaScript payloads targeting NJS endpoints
SIEM Query:
source="nginx_error.log" AND "segmentation fault" OR "SIGSEGV"