Safe Check CVE-2025-23419 - NGINX mTLS Session Resumption

Repository with a safe validation script for CVE-2025-23419, a vulnerability related to NGINX, mTLS, and TLS session resumption.

The script performs a heuristic check to identify possible exposure to the flaw, without executing active exploitation and without attempting to bypass client certificate authentication.

Its purpose is to support technical triage, defensive validation, and exposure analysis in authorized environments.

CVE covered

Vulnerability summary

CVE-2025-23419 affects scenarios where multiple NGINX server blocks share the same IP and port, and the environment uses client certificate authentication, also known as mTLS.

In certain configurations, an attacker could reuse a previously established TLS session to bypass client certificate authentication requirements in another virtual host context.

The vulnerability is related to the use of TLS session resumption, especially when ssl_session_cache or ssl_session_tickets are enabled.

In practice, exposure depends on the combination of a vulnerable version, use of TLS 1.3, TLS session configuration, multiple virtual hosts, and mTLS application in specific parts of the environment.

Affected versions

According to public advisories, the issue affects:

NGINX 1.11.4 and later versions

When the following conditions are present:

NGINX compiled with OpenSSL
TLS 1.3 enabled
Session resumption enabled
Use of ssl_session_cache or ssl_session_tickets
Multiple server blocks sharing the same IP and port
mTLS/client certificate authentication in some virtual host

The fix was published in versions:

NGINX 1.26.3
NGINX 1.27.4

Therefore, a version like:

nginx/1.24.0

should be treated as potentially vulnerable, as long as the configuration scenario is also compatible with the flaw.

Important: the vulnerable version alone does not confirm exploitation. It indicates the need for configuration validation.

Available script

What the script does

The script performs safe validations to gather indications of the vulnerability:

• tries to identify the Server header;
• checks if the service appears to be NGINX;
• extracts the NGINX version when exposed;
• compares the version with the potentially vulnerable range;
• tries to infer whether the endpoint requires mTLS;
• checks for signs of TLS session resumption;
• tests a random SNI/Host to identify possible vhost/default without mTLS on the same IP and port;
• returns a simple output indicating POSSIBLE or NOT_INDICATED.

What the script does not do

This script does not exploit the vulnerability.

It does not attempt to:

• bypass mTLS authentication;
• access a protected area;
• use a valid client certificate;
• reuse a session between different vhosts offensively;
• cause unavailability;
• perform brute force;
• modify data in the environment.

The purpose is only to gather technical indications to support triage and defensive validation.

Ideal scenario for use

Use this script when one or more of the following indications are present:

Server exposes nginx/1.24.0
Environment uses mTLS
There are multiple virtual hosts on the same IP and port
TLS 1.3 is in use
There is suspicion that ssl_session_cache or ssl_session_tickets are enabled
Automated tool flagged CVE-2025-23419

Examples of suitable targets:

https://api.example.com.br/
https://admin.example.com.br/
https://mtls.example.com.br/
https://gateway.example.com.br/

Script usage

Basic example

python3 safe-check-CVE-2025-23419.py https://example.com.br/

Example with verbose output

python3 safe-check-CVE-2025-23419.py https://example.com.br/ --verbose

Example with JSON output

python3 safe-check-CVE-2025-23419.py https://example.com.br/ --json

Example changing timeout

python3 safe-check-CVE-2025-23419.py https://example.com.br/ --timeout 10

Interpreting results

POSSIBLE result

POSSIBLE

Indicates that the script found indications compatible with possible exposure to CVE-2025-23419.

This does not confirm exploitation. It means the environment merits manual analysis of the NGINX configuration and validation with the responsible team.

Example of verbose output:

POSSIBLE
  nginx_header: nginx/1.24.0
  nginx_ver: (1, 24, 0) (vuln? True)
  mtls_hint: True
  tls: TLSv1.3
  resumption_reused: True
  other_vhost_no_mtls_hint: True

These data help understand why the endpoint was classified as possible exposure.

NOT_INDICATED result

NOT_INDICATED

Indicates that the script did not find sufficient indications to point to possible exposure on that endpoint.

This does not guarantee the absolute absence of the vulnerability, especially if:

• the Server header is hidden;
• the NGINX version is not exposed;
• mTLS is on another virtual host;
• the load balancer/CDN is masking the actual NGINX;
• validation is being performed on the wrong endpoint;
• the actual NGINX configuration cannot be inferred externally.

Adjustable fields in the script

The main points that can be adjusted are:

CERT_ERROR_STATUS = {400, 401, 403, 495, 496}

This list represents HTTP codes that may indicate a failure related to an absent or invalid client certificate.

It is also possible to adjust the timeout via command line:

--timeout 10

Requirements

Dependencies

The script uses only Python standard libraries.

Main dependencies:

python3
ssl
socket
argparse
urllib

No external libraries need to be installed via pip.

Mitigation recommendations

Update NGINX to a fixed version, preferably 1.26.3, 1.27.4 or higher, according to the channel used.

Review the configuration of server blocks that share the same IP and port, especially when there is mTLS on only part of the virtual hosts.

Evaluate the use of:

ssl_session_cache
ssl_session_tickets
TLS 1.3
server blocks sharing IP and port
mTLS applied to specific virtual hosts

It is also recommended to isolate contexts requiring client certificate and validate whether mTLS authentication is being applied to the correct virtual host.

Additionally, review configurations in proxies, gateways, load balancers, ingress controllers, and CDNs, as the component terminating TLS may not be the same one responding to the final application.

References

https://mailman.nginx.org/pipermail/nginx-announce/2025/NYEUJX7NCBCGJGXDFVXNMAAMJDFSE45G.html
https://nvd.nist.gov/vuln/detail/CVE-2025-23419
https://ubuntu.com/security/CVE-2025-23419
https://github.com/advisories/GHSA-84xh-pwc6-7g4g
https://access.redhat.com/security/cve/cve-2025-23419

Legal disclaimer

This script should only be used in authorized environments.

Its purpose is to support triage, safe validation, authorized penetration testing, defensive analysis, and confirmation of configuration exposure.

Use against systems without authorization is prohibited.