CVE-2018-9230 describes a critical vulnerability in OpenResty versions through 1.13.6.1, where the ngx.req.get_uri_args and ngx.req.get_post_args functions ignore URI parameters beyond the hundredth. This flaw, with a CVSS score of 9.8 (CRITICAL), could allow remote attackers to bypass access restrictions or interfere with Web Application Firewalls (WAFs) like ngx_lua_waf or X-WAF, leading to high impact on confidentiality, integrity, and availability. While OpenResty considers the 100-parameter limit an intentional, adjustable default, and places responsibility on WAF products for misuse, the vulnerability has a high FAUCET Risk Score of 98/100 and an EPSS score indicating a higher-than-average likelihood of exploitation. There is no evidence of active exploitation, nor are there public exploits in Metasploit, Nuclei, or ExploitDB, though it has garnered significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.13.6.1CPE matchmatch criteria | cpe:2.3:a:openresty:openresty:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.