ngx_cache_purge symlink traversal fix in ngx_walk_tree

Vulnerability Overview This vulnerability involves a failure to respect symbolic links when traversing the cache tree. Specifically, the function on Unix systems stat()s every directory entry (including symbolic links). Since symbolic links are treated as real directories within the cache path, this affects , , and cleanup operations. This can lead to the unintended cleanup of directories pointed to by malicious symbolic links. Impact Scope Affected Versions: and Affected Module: module Potential Risk: Malicious users may influence cache cleanup operations by creating symbolic links, potentially leading to data loss or system instability. Remediation 1. Code Modifications: - Modify the function to return when a symbolic link is encountered, thereby skipping these symbolic links. - Ensure that the cache root path is not passed to this handler to prevent incorrect handling of symbolic links. 2. Test Coverage: - Add new test cases (Tests 25 and 26) to verify the effectiveness of the fix, ensuring that symbolic links are not traversed. 3. Security Recommendations: - It is recommended that maintainers add a file so that future reports can be submitted privately. POC Code Summary This vulnerability is addressed by modifying the function to prevent the traversal of symbolic links, ensuring the security of cache cleanup operations. The remediation includes code modifications and the addition of new test cases to verify the fix. It is recommended that maintainers add a security policy file to allow future reports to be submitted privately.

Goal Reached Thanks to every supporter — we hit 100%!

ngx_cache_purge symlink traversal fix in ngx_walk_tree

More from this source