CVE-2022-4174_CVE-2022-41742

PoC for CVE-2022-4174_CVE-2022-41742 to determine if Nginx 1.22.1 is vulnerable

[email protected]

This PoC allows determining if an Nginx server version 1.22.1 is vulnerable to certain known vulnerabilities, including:

• CVE-2022-41741: Memory corruption in the ngx_http_mp4_module.
• CVE-2022-41742: Memory disclosure in the ngx_http_mp4_module.
• CVE-2023-44487: HTTP/2 Rapid Reset Attack.

Memory disclosure in the ngx_http_mp4_module (CVE-2022-41742): Before versions 1.23.2 and 1.22.1, Nginx has a vulnerability in the ngx_http_mp4_module that could allow a local attacker to cause a worker process crash or disclose process memory information through the use of specially crafted audio or video files. ​

Memory corruption in the ngx_http_mp4_module (CVE-2022-41741): Similar to the previous one, this vulnerability could allow an attacker to cause a worker process crash or potentially execute arbitrary code through malicious MP4 files. ​

Requirements

• Python 3.x
• requests library

To install requests, use:

pip install requests

Usage

1. Modify the TARGET_URL variable in the script with the URL of the server you want to test.
2. Run the script:
   root@kitploit:~

   python nginx_poc.py
   

Operation

1. Nginx version detection: Gets the Server header to verify if the server uses Nginx and its version.
2. ngx_http_mp4_module verification: Attempts to access a .mp4 file to determine if the module is enabled.
3. Vulnerability analysis:
   • If version 1.22.1 is detected, it warns about potential vulnerabilities.
   • If the ngx_http_mp4_module is present, it alerts about CVE-2022-41741 and CVE-2022-41742.
   • It reports on CVE-2023-44487 and recommends mitigating HTTP/2 if enabled.

Recommended mitigations

• Update Nginx to a newer version without the mentioned vulnerabilities.
• Disable ngx_http_mp4_module if not necessary.
• Apply mitigations for HTTP/2 Rapid Reset Attack, such as limiting the number of connection resets per client.

Warning

This script only checks for the presence of potential vulnerabilities based on public information. It does not actively exploit any vulnerability and must be used with explicit authorization.