CVE-2024-7634 NGINX Agent Vulnerability
A privileged attacker can write or overwrite files outside the secure directory due to a path traversal flaw in NGINX Agent.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-7634?
CVE-2024-7634 is a medium-severity path traversal vulnerability in F5 NGINX Agent, published on 22 Aug 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
NGINX Agent's "config_dirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory.
Weakness: CWE-22
Which versions are affected by CVE-2024-7634?
1 open source package ship an affected version, including nginx-agent. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
nginx-agent Bitnami | From 2.17.0 | 2.37.0 |
Products include F5 Nginx Agent, F5 Nginx Instance Manager.
How do I fix CVE-2024-7634?
Upgrade nginx-agent to 2.37.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-7634 being exploited?
There is no known exploitation of CVE-2024-7634 in the wild and no public exploit code.
Other vulnerabilities in F5 NGINX Agent
Sources
Also known as BIT-nginx-agent-2024-7634, GHSA-f3wr-j648-3c97.