CVE-2024-7347
📋 TL;DR
This vulnerability in NGINX's ngx_http_mp4_module allows attackers to cause memory over-read and worker process termination by uploading specially crafted MP4 files. Only NGINX installations built with the mp4 module and using the mp4 directive in configuration are affected. Attackers must be able to trigger processing of malicious MP4 files to exploit this.
💻 Affected Systems
- NGINX Open Source
- NGINX Plus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Denial of service causing NGINX worker process termination, potentially disrupting web services if multiple workers are affected
Likely Case
Targeted DoS attacks against specific NGINX instances serving MP4 content, causing service interruptions
If Mitigated
Minimal impact with proper input validation and monitoring in place
🎯 Exploit Status
Exploitation requires ability to upload/trigger processing of specially crafted MP4 files
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000140529
Restart Required: Yes
Instructions:
1. Check NGINX version and configuration for mp4 module usage. 2. Apply vendor patches from official sources. 3. Restart NGINX service. 4. Verify patch application and functionality.
🔧 Temporary Workarounds
Disable ngx_http_mp4_module
allRemove or comment out mp4 directive in NGINX configuration files
# Edit nginx.conf and remove 'mp4;' directives
# Reload configuration: nginx -s reload
Restrict MP4 file uploads
allImplement strict file upload controls and validation for MP4 files
# Configure location blocks to restrict MP4 processing
location ~ \.mp4$ { deny all; }
🧯 If You Can't Patch
- Disable mp4 module in NGINX configuration if not required
- Implement WAF rules to block suspicious MP4 file uploads and processing attempts
🔍 How to Verify
Check if Vulnerable:
Check NGINX configuration for 'mp4;' directives and verify module is compiled: nginx -V 2>&1 | grep mp4Check Version:
nginx -vVerify Fix Applied:
Verify NGINX version after patching and confirm mp4 module is either disabled or patched📡 Detection & Monitoring
Log Indicators:
- NGINX worker process crashes
- Error logs showing memory access violations
- Unusual MP4 file processing errors
Network Indicators:
- Multiple failed MP4 file upload attempts
- Unusual traffic patterns to MP4 endpoints
SIEM Query:
source="nginx" AND ("worker process" AND crash) OR ("mp4" AND error)