nginx Zero-Day RCE flaw affects nginx 18.1. According to the AgainstTheWest Github repo, this bug relates to the LDAP-auth daemon within nginx.

Update 1:

As some further analysis is ongoing, the module relating to the LDAP-auth daemon within nginx is affected greatly. 😉 Anything that involves LDAP optional logins works as well. This includes Atlassian accounts. Just working out if we can bypass some common WAFs. Default nginx configs seem to be the vulnerable type, or common configs.

We highly recommend disabling the ldapDaemon.enabled property. If you plan on setting it up, be sure to change the ldapDaemon.ldapConfig properties flag with the correct information and don’t leave it on default. This can be changed until Nginx (fucking) respond to their emails and DMs.

Update 2:

Been talking to some infosec people about this, some mixed responses. Some are saying it’s a problem with LDAP itself and not Nginx, while ldapDaemon isn’t always used. The exact quote is “CI/CD pipeline hardens the instance, one of the steps is to completely strip out the LDAP module.”. This is partially correct. In fact, it is an option when compiling nginx. However, it could be a problem with LDAP itself.

The issue with this, is that it only works with nginx instance using LDAP, such as any login portal that supplies that authentication method.

Further analysis and testing is required. Looks to only be affecting this version. If it affects updated versions of the LDAP protocol, then we’ll see what comes of that.

Hackers have exploited this flaw in the wild. As this vulnerability does not currently have a patch, it is strongly advised that admins using the nginx web server deploy these mitigations as soon as possible.

‘,enableHover:false,enableTracking:true,buttons:{twitter:{via:’the_yellow_fall’}},click:function(api,options){api.simulateClick();api.openPopup(‘twitter’);}});$(‘#facebook’).sharrre({share:{facebook:true},template:’‘,enableHover:false,enableTracking:true,buttons:{layout:’box_count’},click:function(api,options){api.simulateClick();api.openPopup(‘facebook’);}});$(‘#pinterest’).sharrre({share:{pinterest:true},template:’‘,enableHover:false,enableTracking:true,buttons:{pinterest:{description:’Nginx Zero-Day RCE Vulnerability Alert’,media:’https://cdn-0.securityonline.info/wp-content/uploads/2022/04/Screenshot-2022-04-10-115506.png’}},click:function(api,options){api.simulateClick();api.openPopup(‘pinterest’);}});$(‘#linkedin’).sharrre({share:{linkedin:true},template:’‘,enableHover:false,enableTracking:true,buttons:{linkedin:{description:’Nginx Zero-Day RCE Vulnerability Alert’,media:’https://cdn-0.securityonline.info/wp-content/uploads/2022/04/Screenshot-2022-04-10-115506.png’}},click:function(api,options){api.simulateClick();api.openPopup(‘linkedin’);}});var $_shareContainer=$(“.sharrre-container”),$_header=$(‘#header’),$_postEntry=$(‘.entry’),$window=$(window),startSharePosition=$_shareContainer.offset(),contentBottom=$_postEntry.offset().top+$_postEntry.outerHeight(),topOfTemplate=$_header.offset().top,topSpacing=_setTopSpacing();shareScroll=function(){var scrollTop=$window.scrollTop()+topOfTemplate,stopLocation=contentBottom-($_shareContainer.outerHeight()+topSpacing);$_shareContainer.css({position:’fixed’});if(scrollTop>stopLocation){$_shareContainer.css({position:’relative’});$_shareContainer.offset({top:contentBottom-$_shareContainer.outerHeight(),left:startSharePosition.left,});}
else if(scrollTop>=$_postEntry.offset().top-topSpacing){$_shareContainer.css({position:’fixed’,top:’100px’});$_shareContainer.offset({left:startSharePosition.left,});}else if(scrollTop1024){topSpacing=distanceFromTop+$(‘.nav-wrap’).outerHeight();}else{topSpacing=distanceFromTop;}
return topSpacing;}
$window.on(‘scroll’,ezoicSiteSpeed({objOrFunction:_.throttle,object:_,function:String(/throttle/).substring(1).slice(0,-1)},String(/documentReady/).substring(1).slice(0,-1),String(/jQuery-document-ready/).substring(1).slice(0,-1),function(){if($window.width()>719){shareScroll();}else{$_shareContainer.css({top:”,left:”,position:”})}},50));$window.on(‘resize’,ezoicSiteSpeed({objOrFunction:_.debounce,object:_,function:String(/debounce/).substring(1).slice(0,-1)},String(/documentReady/).substring(1).slice(0,-1),String(/jQuery-document-ready/).substring(1).slice(0,-1),function(){if($window.width()>719){shareMove();}else{$_shareContainer.css({top:”,left:”,position:”})}},50));});