Executive Summary

This vulnerability exists in NGINX Plus when it is configured as the data plane for NGINX Gateway Fabric. It is an injection vulnerability in the NGINX configuration generator component of NGINX Gateway Fabric.

Specifically, user-supplied string values from the NginxProxy Custom Resource Definition serverTokens field and the AuthenticationFilter Custom Resource Definition extraAuthArgs field are inserted directly into NGINX configuration templates without any sanitization or escaping.

An authenticated attacker who has permission to create or modify these Custom Resource Definitions can craft values that inject arbitrary NGINX configuration directives, potentially altering the behavior of the NGINX configuration.

This is a control plane issue, meaning the vulnerability affects configuration management rather than the data plane itself, and there is no direct data plane exposure from triggering this vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated attacker with permission to modify certain Custom Resource Definitions to inject arbitrary configuration directives into NGINX.

Such injection could lead to unauthorized changes in the behavior of the NGINX server, potentially compromising the security or stability of the system.

Because the vulnerability is in the control plane, it may allow attackers to manipulate configuration settings, which could result in denial of service, bypass of security controls, or other unintended behaviors.

Useful 0 Not Useful 0