Attackers exploit NGINX flaw CVE-2024-42945 after disclosure

A critical security vulnerability in widely used NGINX web server software is now being actively exploited by attackers just days after its public disclosure, cybersecurity researchers report. The flaw, tracked as CVE-2024-42945 and dubbed "Nginx Rift," allows unauthenticated attackers to crash web servers and, under specific conditions, potentially execute malicious code.

The heap-based buffer overflow vulnerability resides in the ngx_http_rewrite_module and affects NGINX Open Source versions 0.6.27 through 1.30.0, NGINX Plus versions R32 through R36, and several integrated F5 products. Researchers at Depthfirst, who discovered the flaw using an AI-assisted platform, explained that exploitation requires a specific and relatively uncommon server configuration. A server must have a rewrite directive using an unnamed regular expression capture group followed immediately by another rewrite, if, or set directive. When this configuration exists, a specially crafted HTTP request can trigger a miscalculation in memory allocation, causing data to be written past its allocated buffer.

This deterministic memory corruption can force NGINX worker processes to crash repeatedly, leading to a...