New Nginx Exploit
443 points
• 4 days ago
• Article
Link
该仓库包含针对 CVE-2026-42945 的概念验证利用代码。该漏洞存在于 NGINX 的 `ngx_http_rewrite_module` 中，可追溯到 2008 年，是一起严重的堆缓冲区溢出问题。使用 `rewrite` 和 `set` 指令的服务器可被未认证地远程执行任意代码。与另外三个内存损坏问题（CVE-2026-42946 、 CVE-2026-40701 、 CVE-2026-42934）一起，该漏洞由 DepthFirst 的安全分析系统在一次接入 NGINX 源代码后自动发现。
漏洞源于 NGINX 双遍脚本引擎处理过程中的不一致：先进行长度计算以确定所需缓冲区大小，再执行数据复制。当 `rewrite` 的替换字符串包含 `?` 时，主引擎会设置 `is_args` 标志，但长度计算是在一个全新且已清零的子引擎上进行的。因此长度遍看到 `is_args = 0` 并返回原始捕获长度，而复制遍看到 `is_args = 1`，并以 `NGX_ESCAPE_ARGS` 调用 `ngx_escape_uri`，把每个可转义字节扩展为 3 字节。结果复制操作会用攻击者控制的 URI 数据溢出分配不足的堆缓冲区。
攻击利用跨请求的堆布局（heap feng shui）来破坏相邻 `ngx_pool_t` 结构的 `cleanup` 指针。由于 URI 字节不能包含空字节，攻击者通过 POST 请求体进行喷射以污染该指针，从而把执行流重定向到伪造的 `ngx_pool_cleanup_s`，在内存池销毁时触发对 `system()` 的调用，进而实现远程代码执行。
受影响的 NGINX Open Source 版本为 0.6.27 到 1.30.0，已在 1.31.0 和 1.30.1 中修复；NGINX Plus 受影响的版本为 R32 到 R36，已在 R36 P4 、 R35 P2 和 R32 P6 中修复。
仓库包含可在 Ubuntu 24.04.3 LTS 上测试的部署脚本和 Python 概念验证代码。用户可以用 `./setup.sh` 构建容器，运行 `docker compose -f env/docker-compose.yml up` 启动易受攻击的 NGINX 服务器，并使用 `python3 poc.py --shell` 弹出 shell 。该项目在 GitHub 上获得了 422 颗星和 76 个 fork，主要贡献者为 Zhenpeng Lin (Markakd) 。
This repository contains a proof-of-concept exploit for CVE-2026-42945, a critical heap buffer overflow vulnerability in NGINX's `ngx_http_rewrite_module` that dates back to 2008. The bug enables unauthenticated remote code execution on servers using `rewrite` and `set` directives. Along with three other memory corruption issues (CVE-2026-42946, CVE-2026-40701, CVE-2026-42934), it was discovered autonomously by DepthFirst's security analysis system after a single click of onboarding the NGINX source.
The vulnerability stems from a mismatch in NGINX's two-pass script engine process. First, the required buffer size is calculated, then data is copied in. The `is_args` flag is set on the main engine when a `rewrite` replacement contains `?`, but the length-calculation pass runs on a freshly zeroed sub-engine. This means the length pass sees `is_args = 0` and returns raw capture length, while the copy pass sees `is_args = 1` and calls `ngx_escape_uri` with `NGX_ESCAPE_ARGS`, expanding each escapable byte to 3 bytes. The copy then overflows the undersized heap buffer with attacker-controlled URI data.
Exploitation uses cross-request heap feng shui to corrupt an adjacent `ngx_pool_t`'s `cleanup` pointer, sprayed via POST bodies since URI bytes can't contain null bytes. This redirects execution to a fake `ngx_pool_cleanup_s` invoking `system()` on pool destruction. The vulnerability affects NGINX Open Source versions 0.6.27 through 1.30.0, fixed in 1.31.0 and 1.30.1, and NGINX Plus versions R32 through R36, fixed in R36 P4, R35 P2, and R32 P6.
The repository includes setup scripts and a Python proof-of-concept that can be tested on Ubuntu 24.04.3 LTS. Users can build the container with `./setup.sh`, start the vulnerable NGINX server with `docker compose -f env/docker-compose.yml up`, and pop a shell with `python3 poc.py --shell`. The project has garnered 422 stars and 76 forks on GitHub, with the primary contributor being Zhenpeng Lin (Markakd).
101 comments • Comments Link
• 已发布的漏洞利用为了简化演示禁用了 ASLR，但完整的技术文章描述了如何利用该漏洞本身绕过 ASLR，使其在启用 ASLR 的系统上依然构成严重威胁。 ASLR 只是纵深防御的一环，而 LLM 辅助的漏洞利用开发正在迅速降低制作武器化利用的门槛。优先应当修补根本原因，而非单纯依赖缓解措施。
• ASLR 在没有信息泄露的情况下可以完全缓解单个漏洞，但当多个漏洞被串联利用时仍然存在风险。读者有责任对安全声明保持批判性，不能在没有证据的情况下盲信自信的结论。
• 该漏洞需要不寻常的先决条件：在替换字符串中含有问号的 rewrite 指令，后面又跟着引用正则捕获组的 set 指令。许多常见的 nginx 配置（例如在 proxy_set_header 中使用 $host）不受影响，只有那些依赖未命名捕获（如 $1）的配置会受到影响。
• 主流 Linux 发行版并不默认禁用 ASLR，默认通常是模式 1（仅对 PIE 可执行启用 ASLR），而非模式 2（对所有内容强制启用 ASLR）。可以使用 checksec 等工具审计运行中的进程，检查是否缺失必要的加固选项。
• F5 已发布修补版本 1.31.0 和 1.30.1，OpenResty 已发布针对 1.27 和 1.29 的补丁。建议的缓解措施是在重写定义中使用命名捕获而非未命名捕获。
• 由于工作进程通过 fork 共享相同的内存布局，持续触发崩溃可以作为潜在的读取预言机，至少可以可靠地造成拒绝服务。 PoC 假设在演示时禁用了 ASLR，但对有动机的攻击者来说仍然存在真实威胁。
• 虽然像 Caddy 和 Jetty 这样的内存安全替代方案减少了某些类型的漏洞，但它们也有各自的漏洞历史，说明成熟度和安全实现比单纯的语言选择更重要。 Caddy 的静态编译模型对自由软件项目更为简单，但也缺乏传统的插件生态。
• 该漏洞在 nginx 中存在已久，版本号并不总是能准确反映实际的代码变更或安全状态。 Debian 12 和 Ubuntu 24.04 已有可用补丁，用户应通过 apt list nginx 等命令核实具体版本信息。
总体讨论揭示了依赖纵深防御与修补根本原因之间的紧张关系：ASLR 是有价值的屏障，但可以被绕过，前提是攻击者付出足够努力。特定利用链需要不常见的配置，从而降低了大多数用户的攻击面，但漏洞在 nginx 中长期存在凸显了基于 C 的成熟软件中内存安全问题的持久性。内存安全语言虽然带来优势，但并不能免疫其他类别的缺陷，这表明安全开发实践和项目成熟度与语言选择同样重要。社区的响应强调了可行的实际步骤，如使用命名捕获并检查发行版的补丁级别，而不是假定版本号就等同于安全状态。 • The published exploit disables ASLR for simplicity, but the full writeup describes a method to bypass ASLR using the vulnerability itself, making it a serious threat even on systems with ASLR enabled. ASLR is only a defense-in-depth measure, and LLM-assisted exploit development is rapidly lowering the skill barrier for creating weaponized exploits. Patching the root cause should be the priority, not relying on mitigations.
• ASLR can fully mitigate individual vulnerabilities unless there is an information leak, but exploit chains combining multiple vulnerabilities remain a risk. The burden is on readers to critically evaluate security claims rather than trusting confident assertions without evidence.
• The specific vulnerability requires unusual preconditions: a `rewrite` directive with a question mark in the replacement string followed by a `set` directive referencing a regex capture group. Many common nginx configurations like `proxy_set_header` with `$host` are not affected, only those using unnamed captures like `$1`.
• No major Linux distributions disable ASLR by default, though most default to mode 1 (only enabling ASLR for PIE binaries) versus mode 2 (forcing it on everything). Tools like `checksec` can audit running processes for missing hardening options.
• F5 has patched versions 1.31.0 and 1.30.1, and OpenResty has patches for 1.27 and 1.29. The recommended mitigation is to use named captures instead of unnamed ones in rewrite definitions.
• Worker processes share the same memory layout due to forking, enabling potential read oracles through unlimited crashes, making this a reliable denial-of-service at minimum. The PoC assumes ASLR is disabled, but the real threat is to motivated attackers.
• Memory-safe alternatives like Caddy and Jetty have their own vulnerability histories, suggesting maturity and secure implementation matter more than just the language. Caddy's static compilation model is simpler for free software projects despite lacking a traditional plugin system.
• The vulnerability has existed in nginx for a long time, and version numbers can be misleading indicators of actual changes or security status. Debian 12 and Ubuntu 24.04 have patched versions available, and users should check with `apt list nginx` for exact version details.
The discussion reveals a tension between relying on defense-in-depth mitigations versus patching root causes, with ASLR being both a meaningful barrier and a bypassable one given enough attacker effort. The specific exploit requires unusual configuration patterns, reducing the attack surface for most users, but the underlying vulnerability's longevity in nginx highlights how memory-safety issues persist in mature C-based software. Alternatives in memory-safe languages offer some advantages but are not immune to other classes of vulnerabilities, suggesting that secure development practices and maturity are as important as language choice. The community response emphasizes practical steps like using named captures and checking distribution-specific patch levels rather than assuming version numbers reflect security status.