Description

NGINX Plus is a software load balancer, web server, and content cache built on top of open source NGINX. NGINX Plus has exclusive enterprise grade features beyond what's available in the open source offering, including session persistence, configuration via API, and active health checks.

NGINX+ contains a ngx_http_upstream_conf_module module. The ngx_http_upstream_conf_module module allows configuring upstream server groups on-the-fly via a simple HTTP interface without the need of restarting NGINX+. Acunetix determined that it was possible to access this HTTP interface without authentication.

It's recommended to restrict access to the NGINX+ Upstream HTTP interface as it may be used to make changes to your NGINX+ configuration.

Remediation

Restrict access to the NGINX+ Upstream HTTP interface.

References

Related Vulnerabilities