CVE-2024-32760
📋 TL;DR
This vulnerability in NGINX Plus and NGINX OSS allows attackers to cause denial of service by sending specially crafted HTTP/3 requests when the QUIC module is enabled. The worker processes may terminate unexpectedly, potentially disrupting web services. Only systems with HTTP/3 QUIC module configured are affected.
💻 Affected Systems
- NGINX Plus
- NGINX OSS
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through repeated worker process crashes, leading to sustained denial of service and potential resource exhaustion.
Likely Case
Intermittent service interruptions as worker processes restart after crashes, causing degraded performance and availability.
If Mitigated
Minimal impact with proper monitoring and automatic process recovery, though service quality may still be affected during attacks.
🎯 Exploit Status
Attack requires sending HTTP/3 requests to vulnerable endpoints; no authentication needed
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisories for specific patched versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000139609
Restart Required: Yes
Instructions:
1. Check current NGINX version
2. Apply vendor-provided patches
3. Restart NGINX service
4. Verify HTTP/3 functionality
🔧 Temporary Workarounds
Disable HTTP/3 QUIC module
allTemporarily disable HTTP/3 support until patches can be applied
# Edit nginx.conf and remove or comment out 'listen 443 quic;' directives
# Reload configuration: nginx -s reload
🧯 If You Can't Patch
- Implement network filtering to block or rate-limit HTTP/3 traffic
- Deploy WAF with HTTP/3 request inspection capabilities
🔍 How to Verify
Check if Vulnerable:
Check if HTTP/3 is enabled in nginx.conf with 'listen ... quic;' directives and verify NGINX version against vulnerable rangesCheck Version:
nginx -vVerify Fix Applied:
Verify NGINX version is updated to patched release and test HTTP/3 functionality remains operational📡 Detection & Monitoring
Log Indicators:
- Worker process termination messages in error logs
- Unexpected process restarts
- HTTP/3 connection errors
Network Indicators:
- Unusual HTTP/3 traffic patterns
- Repeated HTTP/3 requests to same endpoints
SIEM Query:
source="nginx" AND ("worker process" AND exit) OR ("HTTP/3" AND error)🔗 References
- http://www.openwall.com/lists/oss-security/2024/05/30/4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/
- https://my.f5.com/manage/s/article/K000139609
- http://www.openwall.com/lists/oss-security/2024/05/30/4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/
- https://my.f5.com/manage/s/article/K000139609
