Nginx RCE + Brotli

← Back

There's an RCE vulnerability in Nginx affecting open source versions prior to 1.30.1. Patch to a fixed release first, then install Brotli and configure auto-updates.

Install Nginx

sudo apt install curl gnupg2 ca-certificates lsb-release ubuntu-keyring
curl -fsSL https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /etc/apt/keyrings/nginx-archive-keyring.gpg >/dev/null
sudo tee /etc/apt/sources.list.d/nginx.sources >/dev/null <<'EOF'
Types: deb
URIs: https://nginx.org/packages/ubuntu/
Suites: resolute
Components: nginx
Architectures: amd64
Signed-By: /etc/apt/keyrings/nginx-archive-keyring.gpg
EOF
sudo apt update
sudo apt-get install nginx
nginx -v # should be 1.30+

Install brotli

sudo apt-get update
sudo apt-get install curl gnupg apt-transport-https
apt -v # should be 1.1+
mkdir -p /etc/apt/keyrings/
curl -fsSL https://packagecloud.io/DaryL/libnginx-mod-brotli-stable/gpgkey | gpg --dearmor > /etc/apt/keyrings/DaryL_libnginx-mod-brotli-stable-archive-keyring.gpg
sudo tee /etc/apt/sources.list.d/DaryL_libnginx-mod-brotli-stable.list > /dev/null <<'EOF'
deb [signed-by=/etc/apt/keyrings/DaryL_libnginx-mod-brotli-stable-archive-keyring.gpg] https://packagecloud.io/DaryL/libnginx-mod-brotli-stable/ubuntu resolute main
deb-src [signed-by=/etc/apt/keyrings/DaryL_libnginx-mod-brotli-stable-archive-keyring.gpg] https://packagecloud.io/DaryL/libnginx-mod-brotli-stable/ubuntu resolute main
EOF
sudo apt update
sudo apt-get install libnginx-mod-brotli
sudo apt install libnginx-mod-http-brotli-filter libnginx-mod-http-brotli-static
rm /etc/nginx/modules-enabled/50-mod-http-brotli-filter.conf.removed
rm /etc/nginx/modules-enabled/50-mod-http-brotli-static.conf.removed
# /etc/nginx/nginx.conf
load_module modules/ngx_http_brotli_filter_module.so; # for compressing responses on-the-fly
load_module modules/ngx_http_brotli_static_module.so; # for serving pre-compressed files

Brotli settings

# /etc/nginx/conf.d/brotli.conf
brotli on;
brotli_static on;
brotli_types text/plain text/css application/ecmascript application/json application/pdf application/postscript application/javascript application/x-javascript text/xml application/xml application/xml+rss application/rss+xml text/csv text/javascript image/svg+xml font/opentype application/x-font-ttf;
brotli_comp_level 6;
brotli_min_length 256;      # Minimum size to compress (bytes)
brotli_buffers 16 8k;       # Number and size of buffers
brotli_window 512k;         # Sliding window size

Auto updates

# /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Origins-Pattern {
    "o=nginx.org,n=resolute";
    "site=packagecloud.io,n=resolute";
};

Test

sudo apt update
sudo unattended-upgrade --dry-run --debug

References