Resource exhaustion in nginx-ui - #VU152972

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the node-signature authentication path when staging attacker-controlled request bodies before validating their digest and cryptographic signature. A remote attacker can send concurrent requests with syntactically valid signature metadata to cause a denial of service.

Temporary filesystem capacity, disk I/O, and request-processing resources can be consumed before the requests are rejected.

Affected software

Remediation

External References

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-j3hg-9rp3-5hw9
• https://github.com/0xJacky/nginx-ui/commit/8c9b9a1aff218ee6c980d047b750e49da3c46796

Related Security Bulletins

• Multiple vulnerabilities in nginx-ui