CVE-2024-35200
📋 TL;DR
This vulnerability allows attackers to cause denial of service by sending specially crafted HTTP/3 requests to NGINX servers configured with the QUIC module. When exploited, NGINX worker processes terminate, disrupting web services. This affects NGINX Plus and NGINX OSS deployments using HTTP/3 QUIC.
💻 Affected Systems
- NGINX Plus
- NGINX OSS
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption with NGINX worker processes repeatedly crashing, leading to extended downtime until manual intervention.
Likely Case
Intermittent service disruptions as worker processes crash and restart, causing degraded performance and potential request failures.
If Mitigated
Minimal impact if HTTP/3 QUIC module is disabled or if proper rate limiting and monitoring are in place.
🎯 Exploit Status
Exploitation requires sending crafted HTTP/3 requests, which is straightforward for attackers with network access to vulnerable servers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisories for specific patched versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000139612
Restart Required: Yes
Instructions:
1. Review F5 advisory for patched versions. 2. Update NGINX to patched version. 3. Restart NGINX service to apply changes.
🔧 Temporary Workarounds
Disable HTTP/3 QUIC module
allRemove or comment out HTTP/3 QUIC configuration directives to disable vulnerable functionality
# Edit nginx.conf and remove 'listen 443 quic;' and 'listen [::]:443 quic;' directives
# Reload configuration: nginx -s reload
🧯 If You Can't Patch
- Implement network-level filtering to block or rate limit HTTP/3 traffic to vulnerable servers
- Deploy WAF rules to detect and block malicious HTTP/3 request patterns
🔍 How to Verify
Check if Vulnerable:
Check if NGINX configuration contains 'listen ... quic;' directives and verify NGINX version against patched versions in vendor advisoryCheck Version:
nginx -vVerify Fix Applied:
Confirm NGINX version is updated to patched version and HTTP/3 functionality remains stable under normal traffic📡 Detection & Monitoring
Log Indicators:
- NGINX worker process termination messages in error logs
- Increased frequency of worker process restarts
Network Indicators:
- Unusual HTTP/3 traffic patterns or spikes
- Repeated connection attempts on HTTP/3 ports
SIEM Query:
source="nginx_error.log" AND "worker process" AND (terminated OR exited)🔗 References
- http://www.openwall.com/lists/oss-security/2024/05/30/4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/
- https://my.f5.com/manage/s/article/K000139612
- http://www.openwall.com/lists/oss-security/2024/05/30/4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/
- https://my.f5.com/manage/s/article/K000139612
