Unauthenticated Backup Disclosure in Nginx UI

Repository contains a single Python exploit script (27944.py) and a README. The script is a mass exploitation tool for alleged CVE-2026-27944 affecting Nginx UI versions below 2.3.2. Its workflow is straightforward: normalize targets to HTTP URLs, send GET requests to /api/backup, mark a target vulnerable if the response is HTTP 200 and includes the X-Backup-Security header, optionally save the returned backup blob, decode the header into AES key and IV, decrypt the blob with AES-CBC, write the decrypted ZIP to disk, extract it, and parse app.ini for JWT_SECRET and NODE_SECRET while also noting the presence of database.db. Concurrency is implemented with ThreadPoolExecutor for mass scanning. Output is written under a user-selected results directory, including per-target backup files and results.json. This is not merely a detector: it performs post-access data recovery and credential extraction, making it an operational exploit focused on unauthenticated backup theft and offline decryption rather than code execution.

This repository is a small standalone Python proof-of-concept for CVE-2026-27944 affecting nginx-ui. It contains three files: an Apache 2.0 LICENSE, a README describing the vulnerability and usage, and a single exploit script, cve.py. The script is the only code file and the clear entry point. The exploit targets an exposed nginx-ui backup API endpoint. It sends an HTTP GET request to http://admin.snapped.htb/api/backup, reads the X-Backup-Security response header, splits it on ':', and base64-decodes the two components into an AES key and IV. It then initializes an AES-CBC cipher and treats the HTTP response body as a ZIP archive. For each file inside the archive, it decrypts the blob, removes PKCS-style padding with unpad(..., 16), and writes the plaintext to local files named data1, data2, and so on. Operationally, this is not just a detector: it performs full backup recovery and decryption, so it is a real exploit/abuse script rather than a mere check. The capability described in the README is consistent with the code: if the target exposes backup data and leaks the decryption material in the response header, the script can recover sensitive backup contents such as configuration and database data. The code is hardcoded to a single target URL and has no argument parsing, authentication handling, or payload customization, which fits an OPERATIONAL proof-of-concept rather than a framework-integrated or weaponized exploit.

This repository is a self-contained Docker lab and Python exploit demonstrating a chained zero-credential compromise of nginx-ui. The main exploit is exploit/exploit.py, which performs two stages: first, it abuses unauthenticated GET /api/backup to download an encrypted backup and recover the AES key/IV from the X-Backup-Security header, then decrypts nginx-ui.zip and parses app.ini to extract the [node] Secret. Second, it uses that secret to open an SSE session on /mcp, recover a sessionId, and then invoke privileged MCP tools through unauthenticated POST /mcp_message requests. The intended post-exploitation action is nginx takeover by overwriting default.conf so traffic is proxied to http://malicious_site:80, followed by reload_nginx to make the change live immediately. A reset path restores proxying to http://webapp:80. Repository structure supports the demo: docker-compose.yml launches a vulnerable uozi/nginx-ui:v2.3.1 instance on ports 8080 and 9000, a legitimate webapp container, and a malicious phishing container. nginx-ui/app.ini contains the lab configuration, including an empty Node.IPWhiteList and a node secret. nginx/conf.d/default.conf is the initial legitimate reverse-proxy config. webapp/index.html is the benign login page, while malicious/index.html is a phishing clone with a client-side credential capture panel exposed via ?debug=1 for demonstration. Overall, this is a real exploit repository rather than a detector: it automates credential-less secret extraction, privileged MCP access, configuration overwrite, and live nginx reload to redirect victim traffic.

This repository is a small standalone exploit project with 2 files: a README and a single Python entry point, exploit_enhanced.py. The script is an operational proof-of-concept for CVE-2026-27944 affecting Nginx UI. Its attack chain is clearly described and partially visible in code: it targets a network-accessible Nginx UI instance, downloads an encrypted backup from /api/backup without authentication, parses the X-Backup-Security response header to recover the base64-encoded AES-256-CBC key and IV, decrypts the backup, and extracts secrets from nginx-ui/app.ini. The extracted values include at least JwtSecret, node Secret, and crypto Secret. The script then uses the recovered Node Secret in the X-Node-Secret header to access privileged API functionality, specifically POSTing to api/users to create a new administrator account. After successful user creation, it attempts to log in and retrieve a JWT token, then prints instructions for dashboard and API access. The repository is not part of a larger exploit framework. Based on the README and visible code, this is a real exploit rather than a detector: it automates exploitation, secret extraction, authentication bypass, account creation, and post-exploitation access guidance. The code uses Python standard libraries plus pycryptodome for AES decryption.

Repository contains a single Python exploit script and a README. - Structure: - CVE-2026-27944.py: Standalone CLI tool (argparse) with subcommands: info, scan, exploit. - README.md: Usage instructions, impact, requirements, and mitigation guidance. - Purpose / capability: - Targets Nginx UI <= 2.3.2 and abuses an unauthenticated backup download endpoint (/api/backup). - Detection (scan): Sends an HTTP HEAD request to /api/backup and flags the target as vulnerable if HTTP 200 and the X-Backup-Security header is present. - Exploitation (exploit): Sends an HTTP GET to /api/backup (streamed), extracts the AES-256 key (32 bytes) and IV (16 bytes) from the X-Backup-Security header (format: base64(key):base64(iv)), decrypts the downloaded backup using AES-CBC (pycryptodome), attempts PKCS#7 unpadding (falls back to raw decrypt on padding error), and writes decrypted bytes to a local file (default backup_decrypted.bin). The script notes the decrypted output is likely a ZIP archive. - Notable implementation details: - Normalizes targets by prepending http:// if no scheme is provided. - Uses requests with configurable timeouts; scan avoids downloading the body. - Requires pycryptodome for decryption; otherwise exits with install instructions. - Impact as described by the repo: - Disclosure of database.db, app.ini, nginx.conf, TLS private keys/certs (server.key/server.cert), and ssl/ directory contents—enabling credential theft and potential full server compromise.

Repository purpose: a self-contained lab + PoC exploit demonstrating CVE-2026-27944 (Nginx-UI < 2.3.2) where an unauthenticated attacker can download backups from /api/backup and obtain the AES key/IV from the X-Backup-Security response header, enabling immediate decryption of the backup contents. Structure (9 files): - Root README.md: vulnerability overview, impact, and how to run lab/exploit. - lab/app/server.py: Python HTTPServer-based vulnerable service simulator listening on 0.0.0.0:9000. It generates a backup archive, encrypts inner artifacts with AES-256-CBC, and serves the backup at /api/backup while leaking key material via X-Backup-Security. Also performs retention cleanup of old backups. - lab/exploits/poc.py: operational PoC. Sends unauthenticated GET to {target}/api/backup, saves response to backup.bin, parses X-Backup-Security as base64_key:base64_iv, and (optionally) decrypts and extracts inner encrypted files (nginx-ui.zip, nginx.zip, hash_info.txt) using pycryptodome. It then searches extracted files for CTF{...} flags. - lab/Dockerfile and lab/docker-compose.yml: containerized lab environment exposing port 9000 and an optional attacker container. - lab/requirements.txt: pycryptodome dependency. Exploit capabilities: - Unauthenticated network access to a sensitive backup endpoint (/api/backup). - Key/IV harvesting from a response header (X-Backup-Security). - Offline decryption (AES-256-CBC + PKCS#7 unpadding) and extraction of sensitive data from the downloaded backup. Notable observables: - Primary target endpoint: /api/backup over HTTP. - Header-based key disclosure: X-Backup-Security. - Output artifacts written locally: backup.bin and backup_extracted/ (plus decrypted inner archives/files).