cve/2019/CVE-2019-20372.md

CVE-2019-20372

Description

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

POC

Reference

• http://seclists.org/fulldisclosure/2021/Sep/36
• http://seclists.org/fulldisclosure/2021/Sep/36

Github

• https://github.com/0xleft/CVE-2019-20372
• https://github.com/ARPSyndicate/cvemon
• https://github.com/SexyBeast233/SecBooks
• https://github.com/ginoah/My-CTF-Challenges
• https://github.com/rmtec/modeswitcher
• https://github.com/vigneshsb403/nginx0-HTTP-smugging
• https://github.com/vuongnv3389-sec/CVE-2019-20372
• https://github.com/woods-sega/woodswiki