Naxsi Module for Nginx contains a flaw that allows a remote attacker to traverse outside of a restricted path. The issue is due to the naxsi-ui/ nx_extract.py script not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../). This directory traversal attack would allow the attacker to gain access to arbitrary files.

Upgrade to version 0.46-1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2012-3380 (see also: NVD)
• Secunia Advisory ID: 49811
• Vendor URL: http://code.google.com/p/naxsi/
• Vendor Specific Solution URL: http://code.google.com/p/naxsi/source/detail?r=307
• Other Advisory URL: http://www.openwall.com/lists/oss-security/2012/07/05/1
  http://www.openwall.com/lists/oss-security/2012/07/06/3

• Not Available