STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must prevent the execution of unapproved modules.

DISA Rule

SV-278387r1172701_rule

Vulnerability Number

V-278387

Group Title

SRG-APP-000112

Rule Version

NGNX-APP-000370

Severity

CAT II

CCI(s)

• CCI-001695 - Prevent the execution of organization-defined unacceptable mobile code.

Weight

10

Fix Recommendation

Set permissions on directory containing external modules to read only for "Other" only.

The directory may be organizationally defined. The default path is /usr/lib/nginx/modules.

# chmod o-wx /usr/lib/nginx/modules

Check Contents

Check nginx.conf for external modules being loaded (grep load_module).

If additional modules are being loaded, confirm the directory does not include write or execute for other users.

Determine the path to nginx config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

# grep load_module /etc/nginx/nginx.conf
load_module modules/ngx_http_app_protect_module.so;
# ls -la /etc/nginx/modules
lrwxrwxrwx 1 root root 22 Oct 10 2023 modules -> /usr/lib/nginx/modules
# ls -la /usr/lib/nginx
drwxr-xr-x root root 4096 Jan 30 2024 modules

If directory where modules are loaded is writeable by other, this is a finding.

Vulnerability Number

V-278387

Documentable

False

Rule Version

NGNX-APP-000370

Severity Override Guidance

Check nginx.conf for external modules being loaded (grep load_module).

If additional modules are being loaded, confirm the directory does not include write or execute for other users.

Determine the path to nginx config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

# grep load_module /etc/nginx/nginx.conf
load_module modules/ngx_http_app_protect_module.so;
# ls -la /etc/nginx/modules
lrwxrwxrwx 1 root root 22 Oct 10 2023 modules -> /usr/lib/nginx/modules
# ls -la /usr/lib/nginx
drwxr-xr-x root root 4096 Jan 30 2024 modules

If directory where modules are loaded is writeable by other, this is a finding.

Check Content Reference

M

Target Key

5720