Shulou(Shulou.com)06/01 Report--

This article mainly introduces "Nginx/OpenResty memory leak case analysis". In daily operation, I believe many people have doubts about Nginx/OpenResty memory leak case analysis. The editor consulted all kinds of data and sorted out simple and easy-to-use operation methods. I hope it will be helpful for you to answer the doubts of "Nginx/OpenResty memory leak case analysis". Next, please follow the editor to study!

0x00 vulnerability background

March 18, 2020, 360CERT monitoring found that the openwall oss-security mail group disclosed two vulnerabilities. There is a memory leak / directory traversal vulnerability in nginx/openresty in a specific configuration.

Nginx is a web server with an asynchronous framework and can also be used as a reverse proxy, load balancer, and HTTP cache.

OpenResty is a nginx-based Web platform that adds a LuaJIT engine to nginx to run Lua scripts.

Both vulnerabilities require a specific configuration to trigger.

0x01 risk rating

360CERT assesses the vulnerability

The evaluation method, the threat level, the medium danger influence surface is general.

360CERT recommends that users update nginx/openresty/lua-nignx-module in a timely manner. Do a good job of asset self-check / self-test / prevention to avoid attack.

0x02 vulnerability proof

The test environment is configured as follows

System osx 10.15.3

Some components are not required, and the testing process is only installed by default according to the installation guidelines.

Related configuration fragments

# memleak

Location ~ / memleak {

Rewrite_by_lua_block {

Ngx.req.read_body ()

Local args, err = ngx.req.get_post_args ()

Ngx.req.set_uri (args ["url"], true)

}

}

# directory traversal

Location ~ / rewrite {

Rewrite ^. * $$arg_x

}

The following picture shows Nginx enabling lua-nginx-module

Proof of memory leak

Directory traversal certificate

0x03 affects version

Nginx

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.