cyberharsh/nginx-cve-2017-7529PoC exploit for Nginx integer overflow vulnerability (CVE-2017-7529) enabling out-of-bounds cache read. Includes Docker-based lab environment and Python script for testing.
References:
When Nginx acts as a reverse proxy, it usually caches some files, especially static files. The cached portion is stored in files, where each cache file includes a "file header" + "HTTP response header" + "HTTP response body". If a subsequent request hits the cached file, Nginx will directly return the "HTTP response body" from that file to the user.
If my request contains the Range header, Nginx will return content of the specified length based on the start and end positions I provide. If I craft two negative positions, such as (-600, -9223372036854774591), it may read data at a negative position. If this request also hits the cache file, it may be possible to read the "file header", "HTTP response header", etc., that are located before the "HTTP response body" in the cache file.
Run the test environment:
docker-compose up -d
Visit http://your-ip:8080/ to see the Nginx default page, which is actually the content of port 8081 served via reverse proxy.
Call python3 poc.py http://your-ip:8080/ to read the returned result:
As shown, it reads the "file header", "HTTP response header", etc., that are located before the "HTTP response body" via out-of-bounds access.
If the read is incorrect, adjust the offset address (605) in poc.py.