CVE-2024-24989
📋 TL;DR
This vulnerability allows attackers to cause denial of service by sending specially crafted requests to NGINX servers with HTTP/3 QUIC module enabled. It affects NGINX Plus and NGINX OSS when configured to use the experimental HTTP/3 QUIC module, causing worker processes to terminate.
💻 Affected Systems
- NGINX Plus
- NGINX OSS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage with NGINX worker processes repeatedly crashing, leading to sustained denial of service.
Likely Case
Intermittent service disruptions as worker processes crash and restart, degrading performance and availability.
If Mitigated
Minimal impact if HTTP/3 QUIC module is disabled or proper rate limiting/request filtering is implemented.
🎯 Exploit Status
Attack requires sending specific requests to HTTP/3 endpoints. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisories for specific patched versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000138444
Restart Required: Yes
Instructions:
1. Update NGINX to patched version. 2. Restart NGINX service. 3. Verify HTTP/3 functionality if required.
🔧 Temporary Workarounds
Disable HTTP/3 QUIC Module
allRemove or comment out HTTP/3 QUIC configuration directives
# Edit nginx.conf and remove 'listen 443 quic;' directives
# Remove 'http3' and 'quic' directives from configuration
🧯 If You Can't Patch
- Disable HTTP/3 QUIC module in NGINX configuration
- Implement rate limiting and request filtering for HTTP/3 endpoints
🔍 How to Verify
Check if Vulnerable:
Check if NGINX configuration contains 'listen ... quic;' or 'http3' directivesCheck Version:
nginx -vVerify Fix Applied:
Verify NGINX version is updated and HTTP/3 endpoints remain stable under load📡 Detection & Monitoring
Log Indicators:
- Worker process termination messages
- HTTP/3 connection errors
- Increased process restarts
Network Indicators:
- Unusual HTTP/3 request patterns
- Service disruption on port 443/udp
SIEM Query:
source="nginx" AND ("worker process" AND exit) OR ("quic" AND error)