Exploit for CVE-2026-27944

## https://sploitus.com/exploit?id=966BABA2-BC3F-5066-AAD0-E353928EB863
# CVE-2026-27944 - Nginx-UI Unauthenticated Backup Download

[![CVE](https://img.shields.io/badge/CVE-2026--27944-red.svg)](https://nvd.nist.gov/vuln/detail/CVE-2026-27944)
[![CVSS](https://img.shields.io/badge/CVSS-9.8%20(Critical)-critical.svg)](https://www.first.org/cvss/calculator/3.1)
[![GHSA](https://img.shields.io/badge/GHSA-g9w5--qffc--6762-orange.svg)](https://github.com/advisories/GHSA-g9w5-qffc-6762)

> 🚨 **Critical Vulnerability Lab** - Unauthenticated Backup Download with Encryption Key Disclosure in Nginx-UI

---

## 📖 Overview

This repository contains a fully functional lab environment to demonstrate **CVE-2026-27944**, a critical vulnerability affecting Nginx-UI versions 
cd CVENginix/lab

# Option 1: Local execution
pip install -r requirements.txt
python3 app/server.py

# Option 2: Docker
docker-compose up -d
```

### Running the Exploit

```bash
# In a new terminal
python3 exploits/poc.py --target http://localhost:9000 --decrypt
```

![Server Running](lab/screenshots/server.png)

---

## 📁 Repository Structure

```
CVENginix/
├── lab/                          # Vulnerable lab environment
│   ├── app/
│   │   └── server.py             # Vulnerable server implementation
│   ├── exploits/
│   │   └── poc.py                # Proof-of-concept exploit
│   ├── screenshots/              # Demo screenshots
│   ├── docker-compose.yml        # Docker orchestration
│   ├── Dockerfile                # Container image
│   ├── requirements.txt          # Python dependencies
│   └── README.md                 # Detailed lab documentation
├── screenshots/                  # Root screenshots
└── README.md                     # This file
```

---

## 🎯 Capture The Flag

The lab includes 3 hidden flags to verify successful exploitation:

| Flag | Description |
|------|-------------|
| `CTF{unauthenticated_backup_access_granted}` | Database access |
| `CTF{nginx_config_exposed}` | Nginx configuration |
| `CTF{ssl_private_key_compromised}` | SSL private key |

---

## 📊 Impact Assessment

### What Attackers Can Access

```
backup.zip (decrypted)
│
├── database.db
│   ├── User credentials (hashed passwords)
│   ├── Session tokens
│   └── API keys (live production keys)
│
├── app.ini
│   ├── JWT signing secrets
│   ├── SMTP credentials
│   └── AWS access keys
│
├── nginx.conf
│   ├── Server configuration
│   └── Internal network topology
│
└── ssl/
    ├── server.key (RSA private key)
    └── server.crt
```

### Attack Chain

```mermaid
graph LR
    A[Unauthenticated Request] --> B[/api/backup]
    B --> C[Encrypted Backup + Keys in Header]
    C --> D[Decrypt with Exposed Keys]
    D --> E[Extract Sensitive Data]
    E --> F[Full System Compromise]
```

---

## 🛡️ Mitigation

### Immediate Actions

1. **Upgrade** to nginx-ui ≥ 2.3.3
2. **Rotate** all exposed credentials if compromised
3. **Revoke** any leaked API keys
4. **Regenerate** SSL certificates if keys were exposed

### Code Fix

```go
// Before (Vulnerable)
r.GET("/backup", CreateBackup)  // ❌ No auth

// After (Fixed)
r.GET("/backup", middleware.Auth(), CreateBackup)  // ✓ Auth required

// Remove key disclosure from response
// Store keys server-side or use envelope encryption
```

---

## 📚 References

- [NVD - CVE-2026-27944](https://nvd.nist.gov/vuln/detail/CVE-2026-27944)
- [GitHub Advisory - GHSA-g9w5-qffc-6762](https://github.com/advisories/GHSA-g9w5-qffc-6762)
- [CWE-306: Missing Authentication](https://cwe.mitre.org/data/definitions/306.html)
- [CWE-311: Missing Encryption](https://cwe.mitre.org/data/definitions/311.html)

---

## ⚠️ Legal Disclaimer

This repository is for **educational and research purposes only**.

- ✅ Use for learning about security vulnerabilities
- ✅ Use in controlled lab environments
- ✅ Use with proper authorization
- ❌ Do NOT use against systems you don't own
- ❌ Do NOT use in production environments

---

## 📝 License

MIT License - See [LICENSE](LICENSE) for details.

---

## 🙏 Acknowledgments

- Vulnerability discovered by **0xJacky**
- Original advisory: [GHSA-g9w5-qffc-6762](https://github.com/advisories/GHSA-g9w5-qffc-6762)