Read the docs
TI-2023-24153 Aliases CVE-2023-45132

IgnoreIP/IgnoreCIDR should not trust X-Forwarded-For

Priority MEDIUM 50CWE-693Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-693.

Summary

NAXSI is an open-source maintenance web application firewall (WAF) for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious `X-Forwarded-For` IP matches `IgnoreIP` `IgnoreCIDR` rules. This old code was arranged to allow older NGINX versions to also support `IgnoreIP` `IgnoreCIDR` when multiple reverse proxies were present. The issue is patched in version 1.6. As a workaround, do not set any `IgnoreIP` `IgnoreCIDR` for older versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00985 62nd percentileScored 2026-11-07
Fix Fixed naxsi (wargio): 1.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wargionaxsi1.3 to before 1.61.6Patch availableCNA
  • naxsi Vendorwargio Affected 1.3 to before 1.6 Fixed in 1.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wargio:naxsi:*:*:*:*:*:nginx:*:*1.3 to before 1.6Vulnerablewargio
  • cpe:2.3:a:wargio:naxsi:*:*:*:*:*:nginx:*:* Versions 1.3 to before 1.6 Vulnerable ·wargio

Remediation

  • Fix · CNA naxsi (wargio) Fixed in 1.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-45132

References

Patch 2

Advisory 1

  • TI-2012-02910 Directory traversal vulnerability in naxsi-ui/nx_extract.py in the Naxsi module before… CVSS 2.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences