CVE-2022-34028
📋 TL;DR
CVE-2022-34028 is a segmentation fault vulnerability in Nginx NJS JavaScript engine that occurs when processing malformed UTF-8 sequences. This vulnerability could allow attackers to crash Nginx processes, potentially leading to denial of service. Organizations using Nginx with NJS module enabled are affected.
💻 Affected Systems
- Nginx NJS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through repeated process crashes, potentially enabling denial of service attacks against web applications.
Likely Case
Intermittent service disruptions and instability in Nginx processes handling JavaScript execution.
If Mitigated
Minimal impact if NJS module is disabled or proper input validation is implemented.
🎯 Exploit Status
Proof of concept demonstrates crash via malformed UTF-8 input. Exploitation requires sending specially crafted requests to NJS endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: NJS version 0.7.6 or later
Vendor Advisory: https://github.com/nginx/njs/issues/522
Restart Required: Yes
Instructions:
1. Update NJS to version 0.7.6 or later. 2. Recompile Nginx with updated NJS module. 3. Restart Nginx service.
🔧 Temporary Workarounds
Disable NJS Module
allTemporarily disable NJS JavaScript processing if not required
# Remove or comment out njs directives in nginx.conf
# Example: remove 'js_include', 'js_content', 'js_set' directives
Input Validation
allImplement strict input validation for UTF-8 data before NJS processing
# Configure nginx location blocks to validate input
# Example: limit request sizes, validate content types
🧯 If You Can't Patch
- Implement WAF rules to block malformed UTF-8 sequences
- Monitor Nginx process health and implement automatic restart mechanisms
🔍 How to Verify
Check if Vulnerable:
Check NJS version: njs -v or examine nginx configuration for njs directivesCheck Version:
njs -vVerify Fix Applied:
Confirm NJS version is 0.7.6 or later and test with known malformed UTF-8 inputs📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in Nginx error logs
- Process crashes with core dumps
- Increased 502 Bad Gateway errors
Network Indicators:
- Repeated requests with malformed UTF-8 sequences
- Unusual patterns to NJS endpoints
SIEM Query:
source="nginx_error.log" AND ("segmentation fault" OR "SIGSEGV" OR "core dumped")