BusyBox httpd IP deny rules fail open with invalid CIDR prefixes

Executive Summary

This vulnerability affects BusyBox httpd, where IP deny rules with invalid CIDR prefix lengths fail open. Instead of blocking traffic as intended, the rule becomes ineffective because the parsed IP address gets a zeroed network mask, causing it to match no clients. This allows network clients that should be blocked to access protected content.

Useful 0 Not Useful 0

Detection Guidance

Check BusyBox httpd configuration files for invalid CIDR prefix lengths in IP deny rules. Use commands like grep to search for patterns such as /999 or other non-standard masks in httpd.conf or similar files.

Useful 0 Not Useful 0

Impact Analysis

If you use BusyBox httpd with IP deny rules configured with invalid CIDR masks, unauthorized users may bypass access controls and access protected content. Exploitation requires a misconfigured CIDR mask in the configuration file. The impact is limited since BusyBox httpd is rarely used in production environments.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR or HIPAA. Organizations using BusyBox httpd with misconfigured IP deny rules may fail to enforce proper access controls, increasing the risk of data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Audit configuration files for valid CIDR prefix lengths. Implement network-level access controls like iptables or nftables as the primary enforcement layer. Update BusyBox to a patched version if available.

Useful 0 Not Useful 0