CyberRota Analysis
AI-GeneratedThe ngx_cache_purge module in versions prior to 3.0.4 of Nginx is vulnerable to a symlink attack, allowing an attacker to delete files if Nginx and the application (e.g., WordPress) operate under the same user account. This vulnerability can be exploited if the attacker can create a symlink within the cache path, leading to potential data loss. WordPress users and administrators of Nginx servers should prioritize updating to version 3.0.4 or later to mitigate this risk, especially in shared environments.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)