nginx-rift-detect

Behavioral detection script for CVE-2026-42945 (NGINX Rift) — a heap buffer overflow in ngx_http_rewrite_module present in nginx since 2008.

⚠️ Disclaimer

This tool is intended solely for authorized security testing and research. Only run this against systems you own or have explicit written permission to test. Unauthorized use may violate computer crime laws in your jurisdiction. The author is not responsible for any misuse or damage caused by this tool.

Background

CVE-2026-42945 is a heap buffer overflow in nginx's rewrite script engine (ngx_http_rewrite_module), introduced in version 0.6.27 (2008) and present for ~18 years.

The bug comes from a mismatch between two passes of the rewrite engine:

• Pass 1 (length calculation): sees is_args = 0 → allocates a small buffer
• Pass 2 (data copy): sees is_args = 1 → calls ngx_escape_uri, expanding each escapable byte (like +) to 3× its size → overflows the heap buffer

This allows unauthenticated remote code execution.

Affected versions:

References:

• Original research & PoC — DepthFirstDisclosures
• F5 Security Advisory K000160932

How Detection Works

This script does not attempt RCE. It mimics the PoC's flow using raw sockets:

1. Canary — sends 3 normal requests to confirm the server is stable before testing
2. Heap spray — opens 20 connections to hold memory
3. Trigger — sends GET /api/<349×A><969×+> as a partial HTTP request
4. Probe — if the trigger socket closes unexpectedly (worker crashed and respawned), the target is flagged as vulnerable

Detection relies on crashing a worker process. The nginx master will respawn it immediately, but there will be a brief interruption. Use with caution on production systems.

Usage

# Single target (HTTP)
python3 detect-CVE-2026-42945.py --host 127.0.0.1 --port 80

# Single target (HTTPS)
python3 detect-CVE-2026-42945.py --host example.com --port 443 --tls

# List of targets
python3 detect-CVE-2026-42945.py -l targets.txt

# With threading and output file
python3 detect-CVE-2026-42945.py -l targets.txt --threads 10 -o vulnerable.txt

# More attempts for unreliable targets
python3 detect-CVE-2026-42945.py --host 10.0.0.1 --port 8080 --tries 5

targets.txt format — one per line:

http://example.com
https://example.com:8443
192.168.1.1
192.168.1.1:8080

Options:

--host          Single target host
--port          Port (default: 80, or 443 with --tls)
--tls           Use TLS/HTTPS for single target
-l, --list      File with list of targets
--tries         Detection attempts per target (default: 3)
--threads       Concurrent threads for list scan (default: 5)
-o, --output    Save vulnerable targets to CSV file

Example Output

[*] CVE-2026-42945 NGINX Rift Detection | targets=2 threads=5 tries=3

[*] http://192.168.1.1:80   - nginx/1.28.0
[*] http://192.168.1.2:8080 - nginx/1.31.0

[!!!] VULNERABLE | http://192.168.1.1:80 | nginx/1.28.0 | worker crash (trigger connection closed — worker respawned)
[+]   http://192.168.1.2:8080 - not vulnerable (or timing miss, try --tries 5)

==================================================
[*] Scan complete. 2 targets scanned.
[!!!] 1 VULNERABLE target(s):
      http://192.168.1.1:80 (nginx/1.28.0)
==================================================

Testing Against the Lab

The original repo includes a Docker lab environment:

git clone https://github.com/DepthFirstDisclosures/Nginx-Rift
cd Nginx-Rift
chmod +x setup.sh && ./setup.sh
docker compose -f env/docker-compose.yml up -d

python3 detect-CVE-2026-42945.py --host 127.0.0.1 --port 19321

License

MIT — see LICENSE

Original vulnerability research and PoC: DepthFirstDisclosures