CVE-2024-24990
F5
CVE-2024-24990 allows attackers to crash NGINX servers using specially crafted HTTP/3 requests. This vulnerability affects NGINX Plus and NGINX OSS when the experimental HTTP/3 QUIC module is enabled, leading to termination of worker processes. Although the CVSS score is 7.5, the SOCRadar Vulnerability Risk Score (SVRS) is 30, indicating a moderate level of immediate risk, however, given it's tagged as "In The Wild" constant monitoring is still warranted. Exploitation requires the HTTP/3 module to be active, which is not the default configuration. Successful exploitation results in a denial-of-service, disrupting services relying on the affected NGINX instances. This is a significant security concern because it can impact the availability of web applications. Although the SVRS is low, organizations utilizing the QUIC module in NGINX should investigate and apply mitigations from the vendor advisory to maintain system stability and prevent potential service interruptions.
Description
CVE-2024-24990 is a vulnerability in NGINX Plus or NGINX OSS that can cause NGINX worker processes to terminate when configured to use the HTTP/3 QUIC module. The HTTP/3 QUIC module is not enabled by default and is considered experimental.
Key Insights
- The SVRS for CVE-2024-24990 is 40, indicating a moderate level of risk.
- The vulnerability can be exploited by sending undisclosed requests to the affected server.
- The vulnerability can lead to a denial of service (DoS) attack, which can disrupt the availability of the affected server.
Mitigation Strategies
- Disable the HTTP/3 QUIC module in NGINX Plus or NGINX OSS.
- Update to a version of NGINX Plus or NGINX OSS that has the vulnerability fixed.
- Implement a web application firewall (WAF) to block malicious requests.
Additional Information
- The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
- There are no known active exploits for this vulnerability.
- If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.