// 存在漏洞（2.3.4 之前）
r.GET("/mcp",          AuthRequired(), mcpHandler)
r.POST("/mcp_message", mcpMessageHandler)    // 缺少中间件

// 在 2.3.4 中修复
r.GET("/mcp",          AuthRequired(), mcpHandler)
r.POST("/mcp_message", AuthRequired(), mcpMessageHandler)

  攻击者                              nginx-ui (<2.3.4)
     |   1) GET /mcp  (无需认证)                |
     | -------------------------------------->  |
     |   2) event: endpoint data: /mcp_message?sessionID=XYZ
     | <--------------------------------------  |
     |   3) POST /mcp_message?sessionID=XYZ     |
     |      body: JSON-RPC call_tool "nginx_reload" 或
     |             "edit_config {...}"          |
     | -------------------------------------->  |
     |   4) 200 OK; 工具以完全权限执行
     | <--------------------------------------  |

> 步骤 1  通过以下方式识别 nginx-ui：
>         GET /               (HTML 标题, JS 包)
>         GET /api/settings   (引用 nginx-ui 键的 JSON)
>         通过 header / body 正则表达式提取版本
> 步骤 2  向 /mcp 打开 SSE 流
>         从 "endpoint" 事件中解析第一个 sessionID
> 步骤 3  POST /mcp_message?sessionID=<id>
>         Body: {"jsonrpc":"2.0","method":"tools/list","params":{}}
>         无 Authorization header
> 步骤 4  如果状态码为 200 且 body 包含工具清单，则存在漏洞
>         如果状态码为 401 / 403 / 404，则已修复
>         其他情况则无法确定

git clone https://github.com/your-org/CVE-2026-33032-detector.git
cd CVE-2026-33032-detector
python3 --version      # 3.9 或更高版本
# 无需第三方包。

cp nginx-ui-mcpwn.nse /usr/share/nmap/scripts/
sudo nmap --script-updatedb

# 单个目标
python3 detect_nginx_ui_mcpwn.py --target https://nginx-ui.internal

# 从文件批量扫描
python3 detect_nginx_ui_mcpwn.py --targets targets.txt --workers 20

# JSON (NDJSON) 输出，适合通过管道传递给 jq
python3 detect_nginx_ui_mcpwn.py --target 10.0.0.5:9000 --json | jq .

nmap -p 80,443,9000 --script nginx-ui-mcpwn 10.0.0.0/24
nmap -p 443 --script nginx-ui-mcpwn --script-args "nginx-ui-mcpwn.timeout=8" host.example.com

 _   _       _                  _    _  ___   __  __  ____ ____
| \ | | __ _(_)_ __ __  __     | |  | ||_ _| |  \/  |/ ___|  _ \__      ___ __
|  \| |/ _` | | '_ \\ \/ /_____| |  | | | |  | |\/| | |   | |_) \ \ /\ / / '_ \
| |\  | (_| | | | | |>  <|_____| |__| | | |  | |  | | |___|  __/ \ V  V /| | | |
|_| \_|\__, |_|_| |_/_/\_\     |_____|_||___| |_|  |_|\____|_|     \_/\_/ |_| |_|
       |___/

  CVE-2026-33032 nginx-ui MCPwn 检测器 > 非破坏性

[!] 存在漏洞 https://nginx-ui.internal version=2.3.2 evidence=status=200; body_preview={"jsonrpc":"2.0","id":"...","result":{"tools":[{"name":"edit_config",...
[+] 已修复 https://nginx-ui-patched:9000 version=2.3.4 evidence=status=401; body_preview={"error":"unauthorized"}
[.] 非 nginx-ui https://example.com evidence=fingerprint negative

摘要: 1/3 个目标被标记为存在漏洞

{"target":"https://nginx-ui.internal","reachable":true,"is_nginx_ui":true,"mcp_endpoint_present":true,"session_id_obtained":true,"mcp_message_unauthenticated":true,"vulnerable":true,"nginx_ui_version":"2.3.2","evidence":"status=200; body_preview=...","error":null}

PORT     STATE SERVICE
9000/tcp open  http
| nginx-ui-mcpwn:
|   status: VULNERABLE
|   version: 2.3.2
|   session_id: abc123
|_  evidence: tools/list accepted without credentials