CVE-2023-45132

Date: October 11, 2023

NAXSI is an open-source maintenance web application firewall (WAF) for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious "X-Forwarded-For" IP matches "IgnoreIP" "IgnoreCIDR" rules. This old code was arranged to allow older NGINX versions to also support "IgnoreIP" "IgnoreCIDR" when multiple reverse proxies were present. The issue is patched in version 1.6. As a workaround, do not set any "IgnoreIP" "IgnoreCIDR" for older versions.

Language: C