NGINX Map Directive Regex Capture Heap Buffer Overflow

This is an 11-file, self-contained Python/Docker research repository for CVE-2026-42533, an NGINX HTTP-script-engine heap overflow caused by two-pass LEN/VALUE evaluation and regex `map` capture clobbering. Documentation describes affected versions, patch commits, detection behavior, allocator analysis, and an intended cleanup-handler RCE chain. The `lab/` directory builds vulnerable NGINX 1.31.2 by default, optionally builds patched 1.31.3, disables ASLR for deterministic exploit research, and supplies slow, echo, and raw-dump Python backends. Its NGINX configuration deliberately exposes header- and body-driven vulnerable sinks. The repository provides three progressively capable tools: `poc/diagnose.py` is a non-crashing detector that sends small HTTP requests and identifies vulnerable response divergence versus the patched 500 response; `poc/crash.py` submits an oversized `X-Gadget` header to `/trigger/` and verifies a worker PID change after heap-corruption SIGABRT; and `exploit/exploit.py` performs precise socket-driven heap grooming, sends a NUL-capable request-body overflow to `/x/`, and tries to redirect an NGINX pool cleanup callback to libc `system()`. The command payload creates `/tmp/PWNED_CVE_2026_42533`. The RCE code is credible exploit-development code rather than a detection-only script or fake exploit, but it is highly lab-specific. It hard-codes allocator geometry and a libc `system` address, requires ASLR disabled and GDB-derived snapshot values (`victim_pool`, `trigger_buf`, pool pointers, and request blob) that are currently `None`, so the shipped non-dry RCE path cannot succeed until an operator fills those values for the exact lab process. The confirmed practical capability in the committed default state is vulnerability detection and worker DoS against the deliberately vulnerable configuration.

This repository is a compact exploit lab for CVE-2026-42533 against nginx 1.30.1. It contains four files: a minimal top-level README, a Dockerfile that builds a reproducible Ubuntu-based lab, an environment/setup guide (env.md), and the main Python exploit (poc.py). The Dockerfile downloads nginx 1.30.1, builds two variants of nginx (a normal debug build and an AddressSanitizer build), and clones the PoC repository into the container. The documentation explains that the vulnerable path involves nginx stream/SSL preread/map/regex processing and that separate builds are used for crash analysis versus leak/RCE development. The main exploit logic is in cve-2026-42533-lab/poc.py. It is a real exploit, not merely a detector. It implements several modes exposed via CLI flags: --crash for heap overflow crash reproduction, --leak for information disclosure, --rce for a probabilistic full RCE chain, and --rce-det for a more deterministic RCE path requiring a special nginx configuration and calibrated offsets. The exploit communicates directly with nginx over raw TCP sockets and crafts HTTP requests to specific paths (/l2/, /static/a.txt, /b/abc, /b/zz). It uses heap grooming with multiple held victim connections, partial POST body spraying, and a crafted binary request body that forges nginx pool cleanup structures. The payload places the address of libc system() and an inline command string into attacker-controlled heap data so that corrupted cleanup handling results in command execution. Notable exploit capabilities include: leaking heap/libc pointers from a response body; checking for bad bytes in candidate addresses; shaping allocator state with many concurrent sockets; spraying forged cleanup objects into buffered request bodies; and triggering cleanup-pointer corruption to execute a command. The code is operational rather than framework-integrated: offsets such as LIBC_LEAK_OFFSET, SYSTEM_OFFSET, BODY_DELTA_* and PL_OFF are hardcoded and build-specific, but the exploit chain is complete and intended to achieve actual code execution in the provided lab environment.

Repository is a real exploit PoC suite for CVE-2026-42533, a pre-auth nginx heap overflow plus heap/libc info leak caused by capture-state corruption across two-pass script evaluation. The repo contains 9 files: 5 Python exploit/validator scripts, 2 nginx configs, 1 exploitation writeup, and a README. The main exploit is exploits/poc.py, which targets a local nginx instance on 127.0.0.1:8950 and supports four modes: --crash (trigger ASan-visible heap overflow), --leak (extract libc and heap pointers from oversized response body), --rce (general pre-auth RCE using leak + heap shaping + overflow), and --rce-det (deterministic RCE against a tightly controlled config). The RCE chain uses a leak request to recover libc and heap addresses, opens many victim connections to shape adjacency, frees one to create a hole, then sends a crafted POST /b/abc body that overwrites a neighboring pool cleanup pointer so nginx later calls system() on attacker-controlled command data. Payload construction is hardcoded/basic rather than framework-driven, so maturity is OPERATIONAL. Supporting scripts broaden coverage: calibrate.py derives deterministic offsets by launching nginx and reading /proc/<pid>/maps and /proc/<pid>/mem; leak_multi.py demonstrates the same leak primitive through additional sinks (return and set) on temporary listeners; named_capture_poc.py triggers the related named-capture r->variables[] variant under ASan; test_all_sites.py validates 13 vulnerable HTTP/stream sink sites with temporary nginx configs and ASan. The configs directory provides nginx_poc.conf for crash/leak/general RCE and nginx_det.conf for deterministic RCE. Both expose listen 127.0.0.1:8950 and use proxy_pass to http://127.0.0.1:19999, though the backend need not exist because the overflow occurs before connection. Overall, the repository’s purpose is to reproduce, validate, and weaponize the vulnerability from primitive crash/leak through full pre-auth code execution, while also documenting affected sinks and exploitation details.

This repository is a real exploit research and reproduction project for CVE-2026-42533, a pre-authentication nginx memory corruption issue caused by two-pass complex-value evaluation reusing and clobbering regex capture state. The repo is not a framework module; it is a standalone lab/research repository combining documentation, debug tooling, and exploit helpers. Structure-wise, it has three main purposes: (1) deep technical analysis in ANALYSIS.md and README.md, (2) HTTP-variant reproduction and dynamic debugging under debug/ and http-rift/, and (3) a referenced/ported stream-variant RCE chain. The debug/ directory builds nginx 1.30.3 from source with symbols and --with-debug, exposes gdbserver, and includes Python gdb automation to trace the vulnerable code paths (ngx_http_complex_value, ngx_http_map_variable, ngx_http_regex_exec, capture copy routines). The recon scripts inspect heap layout, overflow landing zones, and leak behavior. The http-rift/ directory contains an alternate nginx lab configuration, a local TCP sink service for heap spraying via /spray, a TLS ClientHello/SNI sender for stream leak testing, and a copied nginx source subtree used for source-level analysis. Main exploit capabilities extracted from the repo are: response/header capture clobbering, heap overflow when attacker-controlled mapped input is longer than the original regex capture, heap information disclosure when it is shorter, and reliable worker crash/DoS. The documentation also states that the stream variant achieves full RCE and supports arbitrary command execution, with the example payload writing /tmp/pwn. The HTTP path in this repo is more of an operational exploit lab than a one-click RCE: it demonstrates the primitives, validates memory corruption and leaks, and includes heap-spray helpers, but the README/analysis explicitly notes that full HTTP RCE remains an engineering task while stream RCE is already reproduced. The primary network target pattern is nginx configured with a regex location and regex map over attacker-controlled input. For HTTP, the trigger is a GET request to /test/<path> with an X-Input header. For stream/TLS testing, the repo includes code that sends a crafted TLS ClientHello with a long SNI to a local port. Overall maturity is OPERATIONAL: the repository contains working exploit primitives, lab automation, and a documented command-execution chain for the stream variant, but it is not packaged as a generalized weaponized framework.

This repository is a standalone Python proof-of-concept exploit suite for the claimed nginx vulnerability CVE-2026-42533, described as a pre-auth heap buffer overflow caused by two-pass evaluation of regex captures and map directives. The repo contains four main Python scripts under exploit/: `leak.py` for information disclosure, `overflow.py` for diagnostic/crash/heap-spray/overflow triggering, `exploit.py` for the full chain combining leak, spray, and RCE, and `analyze.py` for generating a GDB helper script to derive target-specific offsets. Supporting infrastructure includes a Dockerfile, docker-compose file, and a deliberately vulnerable `nginx/nginx.conf` that exposes multiple regex-driven endpoints to reproduce the bug. The exploit capability is substantial: it first abuses `/leak/<long path>` with the `X-Clobber` header to cause a LEN/VALUE mismatch and expose uninitialized heap bytes in the `X-Leak-Result` response header, then scans the leaked bytes for likely libc and heap pointers to bypass ASLR. It next performs heap grooming/spraying and finally targets `/api/abc` (or related variants) with attacker-controlled header/body content to trigger a controlled heap overflow. The intended corruption target is `ngx_pool_cleanup_t`, specifically its handler and data pointers, so that nginx connection teardown calls an attacker-chosen libc function such as `system()` or `execve()` with attacker-controlled arguments. The code also supports crash-only verification, leak-only reconnaissance, manual mode with supplied addresses, and reverse-shell style execution. Fingerprintable targets are primarily local HTTP endpoints on the victim nginx instance: `/leak/`, `/api/`, `/x/`, `/proxy/`, and `/named/`, all served on port 8080 in the included lab environment. Important request/response headers include `X-Clobber`, `X-Overflow`, `X-Leak-Result`, `X-Path`, `X-Leak`, and `X-Named`. The included nginx config logs to `/tmp/nginx-error.log`, and the example command payload writes to `/tmp/pwned`. Overall, this is not merely a detector or README; it is an operational PoC exploit repository with explicit crash, leak, and RCE functionality, though successful RCE depends on target-specific offsets and heap layout tuning.