Debian DSA-6496-1: nginx Security Update — Patch Verification, Exploitation Detection, and Hardening Guide

---
title: nginx Worker Process Spawning Shell or Command Interpreter
id: 3f8a1c94-2b7d-4e51-9a36-8c1d5e7f9021
status: experimental
description: Detects nginx worker processes spawning shells, interpreters, or download utilities — a strong indicator of web server exploitation or webshell activity following compromise of an internet-facing nginx instance.
references:
  - https://security-tracker.debian.org/tracker/DSA-6496-1
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/nginx'
  selection_child_img:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/php'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/base64'
  condition: selection_parent and selection_child_img
falsepositives:
  - Legitimate nginx modules or health-check wrappers that exec helper scripts (rare; baseline per host)
  - certbot or configuration management hooks running under the nginx unit
level: high
---
title: Suspicious Outbound Network Connection from nginx Process
id: 6d2e9b17-4a83-4f02-b5c9-1e7a3d8f6245
status: experimental
description: Detects nginx processes initiating outbound connections to non-standard ports, consistent with reverse shell or C2 activity after exploitation of a web server vulnerability.
references:
  - https://security-tracker.debian.org/tracker/DSA-6496-1
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith: '/nginx'
    Initiated: 'true'
  filter_upstream_http:
    DestinationPort:
      - 80
      - 443
      - 8080
      - 8443
      - 3000
      - 8000
  condition: selection and not 1 of filter_*
falsepositives:
  - Reverse-proxy upstreams on non-standard ports — enumerate your upstream ports and extend the filter
  - OCSP stapling and resolver traffic
level: medium
---
title: Webshell-like File Creation in nginx Web Root or Temp Directories
id: 9c4f7d28-6e15-4b39-a1d4-2f8b6c3e5107
status: experimental
description: Detects creation of executable script files in nginx-served directories or world-writable temp paths by the nginx service account, indicative of post-exploitation webshell deployment.
references:
  - https://security-tracker.debian.org/tracker/DSA-6496-1
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/var/www/'
      - '/usr/share/nginx/'
      - '/srv/www/'
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.py'
      - '.pl'
      - '.sh'
      - '.jsp'
      - '.aspx'
  selection_user:
    User|contains:
      - 'www-data'
      - 'nginx'
  condition: selection_path and selection_ext and selection_user
falsepositives:
  - Application deployments running as www-data (should be rare — deploy as a separate user)
  - CMS upload handlers writing to media directories
level: high

// Hunt: nginx worker spawning shells, interpreters, or downloaders (post-exploitation indicator)
// Requires auditd/Syslog process execution logs or MDE-on-Linux ingestion
let SuspiciousChildren = dynamic(["bash", "sh", "dash", "zsh", "python", "python3", "perl", "php", "curl", "wget", "nc", "ncat", "netcat", "base64"]);
union isfuzzy=true
    (Syslog
    | where Facility == "user" or SyslogMessage has "audit"
    | where SyslogMessage has "nginx"
    | where SyslogMessage has_any (SuspiciousChildren)
    | extend Host = Computer, Message = SyslogMessage
    | project TimeGenerated, Host, Message),
    (DeviceProcessEvents
    | where InitiatingProcessFileName =~ "nginx"
    | where FileName in~ (SuspiciousChildren)
    | project TimeGenerated, Host = DeviceName, Message = ProcessCommandLine, InitiatingProcessCommandLine)
| order by TimeGenerated desc;

// Corroborate: inbound requests to newly created script files in web roots (webshell access)
CommonSecurityLog
| where DeviceProduct has "nginx" or ApplicationProtocol == "HTTP"
| where RequestURL has_any (".php", ".py", ".sh", ".pl")
| where RequestURL has_any ("/tmp", "uploads", "images", "cache")
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, RequestURL, DestinationHostName
| where RequestCount < 50  // low-and-slow access to a single script is more suspicious than hot application endpoints
| order by FirstSeen desc;

-- Hunt: nginx processes with suspicious children or non-upstream outbound connections
SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE Name =~ 'nginx'
   OR (Exe =~ '(bash|sh|dash|python|perl|php|curl|wget|nc|ncat)$'
       AND Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ 'nginx'))

-- Hunt: established outbound connections held by nginx workers
SELECT Pid,
       Name,
       Status,
       Laddr.IP AS LocalIP,
       Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP,
       Raddr.Port AS RemotePort
FROM netstat()
WHERE Name =~ 'nginx'
  AND Status =~ 'ESTABLISHED'
  AND RemotePort NOT IN (80, 443, 3000, 8000, 8080, 8443)

#!/bin/bash
# DSA-6496-1 nginx patch-and-verify script (Debian)
set -euo pipefail

echo "=== Installed nginx package version ==="
dpkg -l | grep -E 'nginx-(common|core|full|light|extras)' || echo "nginx not installed"

echo ""
echo "=== Candidate version from security repo ==="
apt-get update -o Dir::Etc::sourcelist="sources.list.d/*security*" 2>/dev/null || apt-get update
apt-cache policy nginx-common nginx-core 2>/dev/null | grep -A2 -E '^(nginx|  Installed|  Candidate)'

echo ""
echo "=== Applying security updates for nginx ==="
DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y nginx-common nginx-core nginx-full nginx-light nginx-extras 2>/dev/null \
  || DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y nginx

echo ""
echo "=== Validating config before restart ==="
nginx -t

echo ""
echo "=== Restarting nginx (required — package upgrade alone does not replace the running binary) ==="
systemctl restart nginx
sleep 2
systemctl is-active --quiet nginx && echo "nginx is active" || { echo "ERROR: nginx failed to start"; exit 1; }

echo ""
echo "=== Verifying running process version matches patched package ==="
INSTALLED=$(dpkg-query -W -f='${Version}' nginx-common 2>/dev/null || dpkg-query -W -f='${Version}' nginx)
echo "Installed package version: ${INSTALLED}"
RUNNING_BIN=$(readlink -f /proc/$(pgrep -o -f 'nginx: master')/exe)
echo "Running master binary: ${RUNNING_BIN}"
if [ -n "$(find /proc -maxdepth 2 -name exe -lname '*nginx* (deleted)' 2>/dev/null)" ]; then
  echo "WARNING: deleted nginx binary still mapped in memory — a restart did NOT fully take effect. Reboot or restart again."
else
  echo "OK: no stale (deleted) nginx binaries mapped in memory."
fi

echo ""
echo "=== Confirm against the fixed version listed at: ==="
echo "https://security-tracker.debian.org/tracker/DSA-6496-1"

# Find running containers that contain the nginx package
for c in $(docker ps -q); do
  img=$(docker inspect -f '{{.Config.Image}}' "$c")
  ver=$(docker exec "$c" dpkg-query -W -f='${Version}' nginx-common 2>/dev/null || echo "n/a")
  echo "$c  $img  nginx-common: $ver"
done