Symlink Attack in ngx_cache_purge Module

Executive Summary

This vulnerability in ngx_cache_purge before 3.0.4 allows file deletion via a symlink attack. If nginx and a served application run under the same user, an attacker who can create a symlink inside the cache path can trick the module into deleting files outside the intended cache directory during purge operations. The module follows symlinks while walking the cache tree, relying on nginx's stat() function which follows symlinks.

Useful 0 Not Useful 0

Detection Guidance

Check if ngx_cache_purge versions before 3.0.4 are installed using package managers like apt or yum. Inspect nginx configuration for cache purge directives. Manually verify cache directories for unexpected symlinks pointing outside the intended path.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to delete critical files on your system if they have access to create symlinks in the cache directory. This could lead to data loss, service disruption, or unauthorized access to sensitive information, depending on which files are deleted. The impact depends on the privileges of the nginx worker process.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file deletion or data exposure, potentially violating GDPR's integrity principle or HIPAA's integrity and availability requirements. Compliance may be impacted if sensitive data is deleted or exposed due to the flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ngx_cache_purge to version 3.0.4 or later immediately. Review and restrict write permissions on cache directories to prevent symlink creation. Monitor purge operations for unauthorized file deletions.

Useful 0 Not Useful 0