CVE-2020-36309: Openresty Lua-nginx-module Vulnerability

CVE-2020-36309 Overview

CVE-2020-36309 affects the ngx_http_lua_module (also known as lua-nginx-module) shipped with OpenResty. Versions before 0.10.16 allow unsafe characters in arguments passed to the Lua API when mutating a URI, a request header, or a response header. An attacker who can influence values passed to these APIs can inject characters that change the structure of the resulting HTTP request or response.

The issue is network-reachable, requires no authentication, and impacts integrity by enabling header or URI manipulation in downstream processing.

Critical Impact
Unsafe character injection into URI and header mutation APIs can enable HTTP response splitting, header smuggling, and downstream request manipulation in OpenResty deployments using lua-nginx-module before 0.10.16.

Affected Products

OpenResty lua-nginx-module versions before 0.10.16
OpenResty distributions bundling vulnerable ngx_http_lua_module builds
Downstream Linux distributions packaging affected versions (for example, Debian LTS)

Discovery Timeline

2021-04-06 - CVE-2020-36309 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2020-36309

Vulnerability Analysis

The vulnerability resides in the Lua API surface exposed by lua-nginx-module for mutating HTTP request and response state. Functions used to rewrite the request URI or to set request and response headers accepted argument values containing characters that are unsafe in HTTP message structure, including CR (\r) and LF (\n) sequences.

When a Lua handler accepts user-influenced input and passes it to these mutation APIs without sanitization, the resulting HTTP message can contain attacker-controlled line breaks. This enables HTTP response splitting and request header smuggling against proxied upstream services. The upstream fix landed in lua-nginx-module pull request #1654, which adds validation to reject unsafe bytes in these arguments.

Root Cause

The module previously delegated character validation to the caller. Lua code mutating the URI or HTTP headers could pass arbitrary bytes, which the module then serialized directly into the request or response. The fix shifts validation into the module so the API rejects unsafe characters regardless of caller hygiene. See the v0.10.15 to v0.10.16 diff for the implementation.

Attack Vector

Exploitation requires that an attacker can supply input to a Lua handler that mutates a URI or header value. A typical scenario is a rewrite_by_lua_* or header_filter_by_lua_* block that reads a query parameter, cookie, or upstream header and passes it directly to ngx.req.set_uri, ngx.req.set_header, or ngx.header[name]. The attacker injects CRLF sequences to terminate the current header and append new fields, enabling cache poisoning, session fixation, or unauthorized access to upstream routes.

No public proof-of-concept code is documented in the references. See the Hacker News discussion and the NetApp security advisory for further context.

Detection Methods for CVE-2020-36309

Indicators of Compromise

HTTP request or response logs containing raw %0d%0a, \r\n, or literal CR/LF bytes in header values or URIs handled by OpenResty
Unexpected upstream 4xx/5xx responses correlated with Lua-handled routes that mutate headers
Duplicate or malformed Set-Cookie, Location, or Content-Length headers in responses from OpenResty front ends

Detection Strategies

Inventory OpenResty and standalone lua-nginx-module installations and compare versions against 0.10.16
Audit Lua code for calls to ngx.req.set_uri, ngx.req.set_header, ngx.header[...], and ngx.redirect that consume untrusted input
Inspect web access logs and WAF telemetry for CRLF or percent-encoded CRLF sequences in request lines and headers

Monitoring Recommendations

Forward NGINX/OpenResty access and error logs into a centralized analytics platform and alert on header values containing control characters
Add WAF rules that reject requests where decoded header or query values contain \r or \n
Track package update events for openresty and lua-nginx-module across managed hosts to confirm patch deployment

How to Mitigate CVE-2020-36309

Immediate Actions Required

Upgrade lua-nginx-module to version 0.10.16 or later, or update to an OpenResty release bundling the fixed module
Apply distribution patches such as the update referenced in the Debian LTS announcement
Review all Lua handlers that mutate URIs or headers and add explicit sanitization for CR, LF, and NUL bytes before the upgrade is rolled out

Patch Information

The fix is included in lua-nginx-module0.10.16. The relevant code change is tracked in pull request #1654 and visible in the v0.10.15...v0.10.16 comparison. NetApp and Debian have published downstream advisories confirming patched package versions.

Workarounds

Validate and strip control characters from any untrusted input before passing it to Lua header or URI mutation APIs
Place a hardened reverse proxy or WAF in front of OpenResty to block requests containing CRLF sequences in headers, cookies, or query strings
Restrict which Lua handlers are permitted to mutate response headers, isolating untrusted input handling to read-only paths until the patch is applied

bash

# Verify installed lua-nginx-module version
nginx -V 2>&1 | tr ' ' '\n' | grep -i lua

# Debian/Ubuntu: apply the security update
sudo apt-get update
sudo apt-get install --only-upgrade libnginx-mod-http-lua

# OpenResty: upgrade to a release bundling lua-nginx-module >= 0.10.16
sudo apt-get install --only-upgrade openresty