Loading vulnerability…
NGINX versions before 1.17.7 contain an HTTP request-smuggling vulnerability when configured with certain error_page directives that perform URL redirects. In deployments where NGINX is fronted by a load balancer, inconsistent handling of crafted HTTP requests can permit request desynchronization and cause a request to be processed in an unintended context.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a Python proof-of-concept exploit for CVE-2019-20372, a vulnerability in NGINX (before 1.17.7, specifically demonstrated on 1.14.2) that allows HTTP request smuggling and, under certain configurations, unauthenticated file upload and remote code execution. The repository consists of a README.md describing the vulnerability and usage, and a single exploit script (cve_2019_20372.py). The script performs several actions: it retrieves HTTP headers from the target, checks for a vulnerable NGINX version, enumerates allowed HTTP methods, and attempts to exploit the vulnerability by uploading a PHP web shell to '/exploit.php' using an HTTP PUT request. If successful, it verifies the upload by accessing the file and checking for command execution output. The exploit requires the target to be running a vulnerable NGINX version and to allow PUT requests. The main attack vector is network-based, targeting web servers accessible over HTTP/HTTPS.
This repository demonstrates a proof-of-concept exploit for CVE-2019-20372, a request smuggling vulnerability in nginx when using an 'error_page' directive with an http:// URL. The repository contains a vulnerable nginx server configuration (in 'server/nginx.conf') with two virtual hosts: 'localhost' and 'adminhost'. The 'adminhost' server returns a flag when accessed. The exploit ('exploit.py') uses the 'pwn' Python library to send two HTTP requests in a single connection: the first to 'localhost', and the second (smuggled) to 'adminhost'. This leverages the misconfiguration to bypass access controls and retrieve the flag. The repository also includes a Docker setup for the vulnerable server. No real-world endpoints are present; all targets are local to the test environment.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.