Cloudanix VulnDB

CVE-2014-3616

None

CVSS

—

EPSS

5.7%

Published

Dec 8, 2014

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

Older nginx web servers could accidentally let visitors access the wrong website when multiple sites shared the same security settings, potentially exposing private information.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Tampering
Component
Network Service
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

When multiple virtual hosts share an SSL session cache or ticket key, a cached session from one host can be reused against an unrelated host, bypassing intended virtual host isolation and allowing unauthorized access to resources in the wrong context.

Why it matters to the business

Organizations running older nginx versions with multiple HTTPS sites on shared infrastructure face risk of cross-site data exposure or unauthorized access, which can lead to compliance violations, data leaks, and operational disruption; the issue is over a decade old with no active exploitation campaigns reported.

How an attack unfolds

An attacker who can establish an SSL session with one virtual host reuses the cached session identifier or ticket when connecting to a second virtual host that shares the same cache or key material, causing the server to treat the connection as authenticated for the wrong host and grant access to its protected content.

How to fix it

Upgrade nginx to a version later than 1.7.4. Configure distinct ssl_session_cache and unique ssl_session_ticket_key values for each virtual host or server block. Disable session caching or ticket reuse if separate configuration is not feasible.

How to confirm the fix worked

Review nginx configuration files for shared cache directives across server blocks, test that session identifiers from one virtual host are rejected by others, and confirm the running nginx binary version is newer than 1.7.4.

Typical attack path

  1. Identify nginx servers using shared ssl_session_cache or ssl_session_ticket_key across multiple virtual hosts
  2. Establish a valid SSL session with one virtual host
  3. Reuse the session identifier or ticket when connecting to a second virtual host
  4. Access resources or perform actions intended only for the second host

How to detect it

Search web server access logs for successful requests to virtual hosts using session identifiers originally issued for different hosts; inspect nginx error logs for unexpected host context switches during SSL resumption.

What your security team should do

  • Immediately audit all nginx deployments for shared SSL session cache or ticket key configurations
  • Prioritize upgrade of any remaining nginx 0.5.6-1.7.4 instances to current supported releases
  • Implement per-virtual-host session cache and ticket key isolation as a hardening measure
  • Add configuration review for shared caches to future nginx deployment checklists

The record

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 nginx 0 1.6.2-1
Debian:12 nginx 0 1.6.2-1
Debian:13 nginx 0 1.6.2-1
Debian:6.0 nginx 0 0.7.67-3+squeeze4
Debian:7 nginx 0 1.2.1-2.2+wheezy3
Mageia:3 nginx 0 1.2.9-1.3.mga3
Mageia:4 nginx 0 1.4.7-1.1.mga4
Ubuntu:14.04:LTS nginx 0 1.4.6-1ubuntu3.1
openSUSE:Tumbleweed nginx 0 1.11.4-2.5

Related vulnerabilities