CVE-2023-45132

NAXSI is an open-source maintenance web application firewall WAF for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious X-Forwarded-For IP matches IgnoreIP IgnoreCIDR rules. This old code was arranged to allow older NGINX...

CVE-2023-45132

CVE-2023-45132 affects the NAXSI WAF for NGINX. The issue, present from 1.3 up to but not including 1.6, allows bypassing the WAF when a crafted X-Forwarded-For IP matches IgnoreIP/IgnoreCIDR rules. The root cause is how IgnoreIP/IgnoreCIDR were supported with multiple reverse proxies, enabling b...