Autenticação Básica pode ser contornada usando um nome de usuário malformado

This vulnerability allows an attacker to bypass basic authentication within the nginx SPNEGO HTTP Authentication Module. By sending a specially crafted username, an attacker can potentially gain access to resources protected by basic authentication without providing valid credentials. The impact is significant as it can lead to unauthorized access to sensitive data or functionality exposed by the web server. This bypass circumvents the intended security controls, allowing attackers to impersonate legitimate users.

Organizations using nginx with the SPNEGO HTTP Authentication Module and relying on basic authentication for access control are at risk. This includes deployments where basic authentication is used for internal applications or services, and those with legacy configurations that haven't been updated recently.

• nginx / server:

# Check module version
nginx -V 2>&1 | grep -i spnego

• nginx / server:

# Check nginx access logs for suspicious username patterns (e.g., excessively long or containing unusual characters)
grep -i 'username=[[:alnum:]]{100,}' /var/log/nginx/access.log

1. 2021-03-08Disclosure

   disclosure

1. Reservado2020-12-22
2. Publicada2021-03-08
3. Modificada2024-08-03
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2021-21335 is to upgrade the SPNEGO HTTP Authentication Module to version 1.1.1 or later. If immediate upgrading is not possible due to compatibility issues or breaking changes, disabling basic authentication is a viable workaround. This prevents the vulnerability from being exploited, although it may impact legitimate users relying on basic authentication. Review nginx configuration to ensure basic authentication is only enabled where absolutely necessary.