Heap buffer overflow in NGINX WebDAV COPY/MOVE handling

Small standalone Python exploit repository for CVE-2026-27654 targeting nginx ngx_http_dav_module alias path handling. Repository contains one main code file (exploit.py), a README with usage and vulnerability background, and a minimal requirements.txt listing requests and colorama. The exploit is not part of a larger framework. The script is an operational PoC rather than a simple detector. It builds crafted WebDAV MOVE/COPY requests with attacker-controlled Destination paths to trigger the documented size_t underflow/heap overflow condition in vulnerable nginx DAV alias configurations. It supports a crash/check mode for vulnerability validation and additional delivery-oriented modes: write-file, cron-shell, and cron-cmd. Those extended modes indicate the author is attempting to leverage path traversal/alias misrouting to place arbitrary content at attacker-chosen filesystem paths in permissive lab setups, including writing cron jobs under /etc/cron.d for delayed command execution or reverse shell launch. Code structure includes: argument parsing and interactive menu logic; URL normalization helpers; a requests-based HTTP client with stdlib http.client fallback; existence checks using HEAD/GET; crash testing logic; delivery logic for crafted DAV requests; and post-action checks/waits for worker respawn or cron execution. Proxy support is implemented when requests is available, with fallback mode explicitly warning that proxying is unsupported. Fingerprintable observables are limited and mostly user-supplied: target host/URL, optional proxy URL, default test filename testfile.txt, and example paths/URLs in the README such as /etc/cron.d/, /tmp/owned, /tmp/payload, and http://attacker.com/payload. Overall purpose: exploit or validate a remotely reachable nginx WebDAV vulnerability that can reliably crash workers and, in certain writable/misconfigured environments, facilitate arbitrary file write and cron-based command execution.

This repository is a small standalone Python proof-of-concept for CVE-2026-27654, a heap buffer overflow in nginx's ngx_http_dav_module. The repo contains three files: LICENSE, README.md, and the main exploit script poc.py. README.md documents the vulnerability, affected/fixed versions, required nginx configuration, and expected crash behavior. The only code file, poc.py, is the entry point and implements the full exploit flow. The exploit is network/web-based and targets nginx DAV endpoints exposed over HTTP. It first checks target reachability, then optionally uploads a file using HTTP PUT to /uploads/triggerfile.txt. After that it sends a crafted HTTP MOVE request for that file with a Destination header pointing to an absolute URI whose path is /x. The script is explicitly designed around a vulnerable configuration where the DAV location prefix is /uploads/ and nginx uses alias /data/files/. Because the destination path is shorter than the location prefix, nginx performs an unsigned length subtraction that underflows, leading to a wrapped allocation size and an oversized copy, causing heap corruption and typically a worker crash. Capabilities are limited to vulnerability triggering and validation rather than post-exploitation. There is no shell payload, persistence, credential theft, or lateral movement logic. The practical result is remote denial of service against a vulnerable nginx worker, with the script also reporting likely patched behavior (HTTP 400), timeout/restart conditions, or connection reset indicating a crash. Overall, this is a genuine PoC exploit focused on reliable crash reproduction for defensive testing and verification.