CVE-2026-27944

CVE-2026-27944 - Nginx UI Unauthenticated Backup Download & Decryption

https://img.shields.io/badge/python-3.6+-blue.svg

https://img.shields.io/badge/license-MIT-green

https://img.shields.io/badge/PoC-Exploit-red

A proof‑of‑concept (PoC) exploit for CVE‑2026‑27944, a critical vulnerability in Nginx UI ≤ 2.3.2 that allows any unauthenticated attacker to download and decrypt the server’s full backup archive via the /api/backup endpoint.

The backup is encrypted with AES‑256, but the encryption key and Initialization Vector (IV) are exposed in plaintext in the X‑Backup‑Security HTTP response header, enabling immediate decryption.

📦 Features

info – Display detailed information about the vulnerability (description, root cause, impact).

scan – Lightweight check if a target is vulnerable (sends a HEAD request, looks for the X‑Backup‑Security header).

exploit – Download the encrypted backup, extract the key/IV from the header, decrypt the data, and save it to a file.

🚨Impact

If exploited, an attacker can obtain:

User credentials and session tokens (database.db)

Application secrets and API keys (app.ini)

SSL private keys and certificates (server.key, server.cert)

Full Nginx configuration (nginx.conf)

TLS keys for all hosted domains (ssl/ directory)

This typically leads to full server compromise and lateral movement inside the network.

⚙️ Requirements

Python 3.6+

requests library

pycryptodome (for AES decryption)

Install dependencies with:

bash

pip install requests pycryptodome

🔧 Usage

text

usage: CVE-2026-27944.py [-h] {info,scan,exploit} ...

CVE-2026-27944 - Nginx UI Backup Exposure Scanner & Exploit

positional arguments:

{info,scan,exploit} Subcommands

info               Display detailed information about the CVE

scan               Check if a target is vulnerable

exploit            Download and decrypt the backup

optional arguments:

-h, --help show this help message and exit

Examples

1. Show vulnerability information

bash

python3 CVE-2026-27944.py info

3. Scan a target (e.g., 192.168.1.100:9000)

bash

python3 CVE-2026-27944.py scan 192.168.1.100:9000

5. Exploit a vulnerable target and save the decrypted backup

bash

python3 CVE-2026-27944.py exploit 192.168.1.100:9000 -o backup_decrypted.zip

The decrypted file is usually a ZIP archive – rename it to .zip and inspect its contents.

📚 How It Works

The script sends a HEAD request to /api/backup to check for the presence of the X‑Backup‑Security header.

If found, it proceeds with a GET request to download the encrypted backup.

The header value contains the Base64‑encoded AES‑256 key and IV, separated by a colon.

The script decodes them, uses pycryptodome to decrypt the data (AES‑256 CBC mode), and removes PKCS#7 padding.

The decrypted bytes are saved to the specified output file.

⚠️ Disclaimer

This tool is provided for educational and security research purposes only.

Unauthorized testing of systems you do not own or have explicit permission to test is illegal. The author is not responsible for any misuse or damage caused by this script.

🛡️ Mitigation

If you are using Nginx UI, update to version 2.3.3 or later immediately.

Additionally:

Rotate all credentials and secrets that may have been exposed.

Regenerate SSL/TLS certificates.

Never expose administrative interfaces to the public internet – use firewalls or VPNs.

📄 License

This project is licensed under the MIT License – see the LICENSE file for details.

📬 References

MITRE CVE‑2026‑27944 (placeholder)

NVD Entry (placeholder)

Nginx UI Official Site