0xCyberstan/CVE-2026-42533-POC

GitHubRepository PoCExploit

PoC files

9 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a full exploit for CVE-2026-42533, a heap buffer overflow in NGINX. It includes a Python script (poc.py) that chains an information leak to defeat ASLR and a heap overflow to achieve pre-auth remote code execution (RCE) by overwriting a pool cleanup handler to call system(). The repository also contains supporting scripts for calibration, leak validation, and triggering the vulnerability across multiple code paths.

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept exploit for CVE-2026-42533, a publicly disclosed heap buffer overflow in NGINX. All provided scripts and documentation describe legitimate exploit behavior targeting the stated vulnerability: triggering the overflow, leaking heap/libc pointers, and achieving remote code execution via a forged pool cleanup chain. No evidence of concealed backdoor behavior, credential theft, unrelated remote access, persistence mechanisms, or deceptive payloads was observed. The code is consistent with a security research PoC intended for defenders and reproduction.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPythonNginx configuration
Target softwareNGINX
Attack typesHeap-based Buffer OverflowInformation LeakRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact, poc.py, contains code that exercises the CVE-2026-42533 vulnerability to achieve remote code execution. It implements a full exploit chain including an information leak, heap grooming, a heap overflow, and a control-flow hijack to call system(). The README explicitly describes the --rce mode as 'Full pre-auth RCE' and the code confirms this by checking for the creation of a file written by the executed command.

README.md:56-57exploits/poc.py:205-296

Requirements

  • A vulnerable version of NGINX (0.9.6 through 1.30.3, 1.31.2) must be running with a configuration that uses a map directive with regex matching and a string expression referencing the map's regex capture variables before the map output variable.README.md:3-7README.md:21-24
  • The attacker must be able to send HTTP requests to the vulnerable NGINX server.README.md:100-101

Observed behavior

  • The exploit sends a crafted GET request to trigger an information leak, causing the server to return a response body containing uninitialized heap memory, which includes a libc pointer and a heap pointer.exploits/poc.py:33-52docs/EXPLOITATION.md:29-67
  • The exploit uses the leaked pointers to calculate the base addresses of libc and the heap, defeating ASLR.exploits/poc.py:197-201docs/EXPLOITATION.md:58-67
  • The exploit grooms the heap by opening multiple connections and closing one to create a hole, then sends a crafted POST request that triggers a heap buffer overflow, overwriting a neighboring connection's pool metadata.exploits/poc.py:249-269docs/EXPLOITATION.md:103-118
  • The overflow rewrites the pool's cleanup function pointer to point to a fake cleanup structure in the POST body, which contains the address of system() and a command string.exploits/poc.py:74-109docs/EXPLOITATION.md:120-161
  • Closing the corrupted connection causes NGINX to tear down the pool and execute the attacker's command via system(), achieving remote code execution.exploits/poc.py:272-284docs/EXPLOITATION.md:169-180
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Heap overflow trigger, information leak, and RCE chain against NGINX CVE-2026-42533The PoC scripts (poc.py, leak_multi.py, named_capture_poc.py, calibrate.py) and documentation (README.md, EXPLOITATION.md) describe and implement a full exploit chain for the stated vulnerability, including heap grooming, pointer leak, and pool cleanup hijacking to call system(). This is normal exploit behavior against the target.exploits/poc.py:1-393docs/EXPLOITATION.md:1-280README.md:1-245
Command Execution
system("id>/tmp/PWNED")The RCE payload writes the output of 'id' to /tmp/PWNED. This is a standard proof-of-execution marker used in exploit demonstrations and does not indicate a backdoor.exploits/poc.py:206exploits/poc.py:302
Target Identification
NGINX 1.30.1 (affected version of CVE-2026-42533)The exploit is explicitly designed for the vulnerable NGINX version and configuration described in the CVE. It does not target unrelated software or perform actions outside the scope of the vulnerability.README.md:3-24configs/nginx_poc.conf:1-45
Review boundaries

What the analysis did not establish

  • The evidence includes 2 unclassified binary files (total 15168 bytes) that were not analyzed, but their content is not required for classification as the provided text files contain the complete exploit logic.
  • The analysis is based solely on the provided text content; the code was not executed, and its reliability or safety is not verified.
  • Two files (total 15168 bytes) were classified as unclassified/binary and were not analyzed; their content is unknown but they are flagged as metadata-only.
  • The review is limited to the supplied text evidence; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1