Atlas / Skills / cyberstrikeus / Cis Nginx V300 5 2 1

Cis Nginx V300 5 2 1CAUTION

skills/cyberstrikeus/cis-nginx-v300-5-2-1

Agent skill by cyberstrikeus · agents · ai hacking · ai penetration testing · Audited 2026-10-18

⚑ Report / re-scan Source ↗

Open-source AI-powered offensive security harness for automated penetration testing.

Verdict

CAUTION

Grade

Trust score

89 /100

Version

3.0

Hosts

—

License

AGPL-3.0

Stars

3,185

Overview

Open-source AI-powered offensive security harness for automated penetration testing.

Read from source at commit eaf7d03223fcOBSERVED · 2026-10-18

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: cis-nginx-v300-5-2-1
description: "Ensure timeout values for reading the client header and body are set correctly (Manual)"
category: cis-nginx
version: "3.0"
author: cyberstrike-official
tags: [cis, nginx, web-server, reverse-proxy, request-limits, request-filtering]
cis_id: "5.2.1"
cis_benchmark: "CIS NGINX Benchmark v3.0.0"
tech_stack: [nginx, linux, web-server]
cwe_ids: []
chains_with: []
prerequisites: []
severity_boost: {}
---

# CIS 5.2.1 — Ensure timeout values for reading the client header and body are set correctly

## Profile Applicability

- Level 1 - Webserver
- Level 1 - Proxy
- Level 1 - Loadbalancer

## Description

To protect against slow clients holding connections open indefinitely, NGINX supports several timeout directives. The most important ones for client-facing connections are:

- `client_header_timeout`: Sets the maximum time the server will wait for a client to send the request header.
- `client_body_timeout`: Sets the maximum time allowed between sequential read operations when receiving the request body. This timer does not apply to the total time of the transfer.
- `send_timeout`: Sets the maximum time allowed between sequential write operations when sending a response to the client.

If any of these timeouts are reached, the server closes the connection, freeing up resources.

## Rationale

Aggressively low timeout values are a primary defense against slow-read Denial of Service (DoS) attacks. These attacks attempt to exhaust server resources by opening many connections and keeping them alive for as long as possible by sending data extremely slowly. By setting low timeouts, NGINX efficiently closes these malicious connections, preserving resources for legitimate users.

## Impact

Setting these values too low can terminate legitimate connections too early. For example, a user uploading a large file over a slow mobile connection could be cut off if `client_body_timeout` is too aggressive. The values must be carefully evaluated to achieve a balance between security (low values) **and** functionality (higher values for specific use cases such as file uploads).

## Audit Procedure

Run the following command to inspect the fully loaded NGINX configuration for the relevant directives:

```bash
nginx -T 2>/dev/null | grep -E '^\s*(client_header_timeout|client_body_timeout|send_timeout)'
```

Verify that these values are explicitly set to a reasonably low, non-default value (e.g., 10-20 seconds) in the main `http` or `server` context. If the application requires long-running connections, verify that `client_body_timeout` is overridden to a higher value in the specific `location` block that handles uploads.

## Remediation

Set reasonably low timeout values globally in your `http` block. If specific locations **require** longer timeouts (e.g., for file uploads), override them within that `location` block.

**Example Configuration:**

```nginx
http {

    # Set a global default of 15 seconds, which overrides the default of 60s.

    client_header_timeout 15s;
    client_body_timeout   15s;
    send_timeout          15s;

    server {
        # ... other settings ...

        # This location handles large file uploads and needs a longer timeout.
        location /upload {

            client_body_timeout 300s; # Allow 5 minutes between read operations for uploads
            # ...
        }
    }
}
```

## Default Value

The default value for `client_header_timeout`, `client_body_timeout`, and `send_timeout` is 60 seconds. This is often considered **too high for public-facing servers**, because it allows slow or malicious clients to uphold connections and resources for an extended period.

## References

1. https://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout
2. https://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout
3. https://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout

## CIS Controls

| Controls Version | Control                                                              | IG 1 | IG 2 | IG 3 |
| ---------------- | -------------------------------------------------------------------- | ---- | ---- | ---- |
| v8               | 16.1 Establish and Maintain a Secure Application Development Process | N    | Y    | Y    |
| v7               | 18.1 Establish Secure Coding Practices                               | N    | Y    | Y    |

## MITRE ATT&CK Mappings

| Tactic | Technique                          |
| ------ | ---------------------------------- |
| Impact | T1499 - Endpoint Denial of Service |
| Impact | T1499.001 - OS Exhaustion Flood    |

## Profile

- Level 1 - Webserver
- Level 1 - Proxy
- Level 1 - Loadbalancer

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	NA
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: none-observed
Shell: none-observed
Dependencies: pinned
Secrets in source: none-found