imbas007/CVE-2026-42533

GitHubRepository PoCExploit

PoC files

10 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a full exploit chain for CVE-2026-42533, a heap buffer overflow in nginx. It includes Python modules for information leaking (leak.py), heap spraying and overflow triggering (overflow.py), and a complete exploit orchestrator (exploit.py) that chains these primitives to achieve remote code execution by corrupting a pool cleanup handler.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a PoC exploit for CVE-2026-42533, a heap buffer overflow in nginx. All reviewed Python scripts (exploit.py, leak.py, overflow.py, analyze.py) and the README.md describe and implement the claimed vulnerability exploitation chain: info leak, heap spray, and overflow to achieve RCE. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm was observed. The code performs only the actions necessary to demonstrate the CVE.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwarenginx
Attack typesHeap Buffer OverflowRemote Code ExecutionInformation Leak
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains multiple Python scripts (exploit.py, leak.py, overflow.py) that actively exploit CVE-2026-42533 to achieve remote code execution. The code performs information leaking, heap spraying, and a heap buffer overflow to corrupt memory and hijack control flow, which is the definition of an exploit. The README explicitly describes it as a 'PoC Exploit' and 'Full Exploit Chain'.

README.md:1-3exploit/exploit.py:1-10exploit/exploit.py:295-422

Requirements

  • Target must be running a vulnerable version of nginx (0.9.6–1.30.3 stable, 0.9.6–1.31.2 mainline) with a specific vulnerable configuration involving a regex-based map directive and a regex location that references both capture variables and the map output variable in the same directive.README.md:12-13README.md:188-201
  • The attacker must be able to send HTTP requests to the target nginx server.exploit/exploit.py:60-68

Observed behavior

  • Sends crafted HTTP GET requests to trigger an information leak, exposing uninitialized heap memory containing libc and heap pointers to defeat ASLR.exploit/leak.py:31-60exploit/exploit.py:80-205
  • Opens multiple keep-alive connections to spray the heap and groom its layout, placing controlled allocations adjacent to the overflow target.exploit/overflow.py:188-241exploit/exploit.py:241-291
  • Sends a crafted HTTP POST request with a body that triggers a heap buffer overflow, corrupting an adjacent ngx_pool_cleanup_t structure to hijack a function pointer and redirect execution to a ROP chain or system() call.exploit/overflow.py:120-159exploit/exploit.py:295-422
  • Provides a diagnostic mode that demonstrates the two-pass size mismatch without crashing the target.exploit/overflow.py:37-84
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The exploit chain sends crafted HTTP requests to a target nginx server to trigger a heap buffer overflow, leak memory, and potentially execute a supplied command.This is the normal and expected behavior for a PoC demonstrating CVE-2026-42533.exploit/exploit.py:57-422exploit/leak.py:21-180exploit/overflow.py:28-289
Command Execution
The exploit accepts a user-supplied command (default 'id > /tmp/pwned') and constructs a ROP chain to execute it via system() or execve().This is the stated goal of the exploit (RCE) and is not a hidden backdoor; the command is explicitly provided by the user running the PoC.exploit/exploit.py:299-300exploit/exploit.py:326-327exploit/exploit.py:494-496
Network Communication
The scripts connect to a user-specified target IP and port to send exploit payloads.This is required for the PoC to function against a target nginx server.exploit/exploit.py:67-69exploit/leak.py:24-27exploit/overflow.py:31-34
Review boundaries

What the analysis did not establish

  • The evidence includes only 5 of 10 files from the repository. The omitted files (Dockerfile, docker-compose.yml, nginx/nginx.conf, exploit/requirements.txt) are not provided, so the vulnerable configuration and build environment cannot be fully verified.
  • The analysis is based solely on static review of the provided source code. The code was not executed, and its claims of reliability or effectiveness on specific targets are not verified.
  • The exploit contains hardcoded offsets and addresses (e.g., DEFAULT_CONFIG in exploit.py) that are specific to a particular build of nginx and glibc. The code's portability to other targets is not assessed.
  • Five files in the repository (including requirements.txt, nginx.conf, Dockerfile, docker-compose.yml) were not included in the text evidence and were not reviewed.
  • Binary files were flagged as metadata-only and not analyzed; none were reported in the evidence.
  • The review is limited to static analysis of the provided source code; dynamic behavior was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2026-42533Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a vulnerable nginx 1.27.4 server from source on Ubuntu 24.04, with a custom nginx.conf designed to demonstrate CVE-2026-42533. The environment includes Python exploit scripts and a GDB analysis helper mounted into the container.

docker-compose.yml:1-18Dockerfile:1-63README.md:1-263

Lab assessment

Vulnerability lab

The environment is explicitly described as a 'CVE-2026-42533 Vulnerable nginx Test Environment' in the docker-compose.yml and README.md. It builds a specific vulnerable nginx version, deploys a configuration containing the vulnerable pattern, and includes exploit scripts and a GDB helper for analysis. All components are directed at reproducing and exercising the vulnerability.

docker-compose.yml:1README.md:1Dockerfile:1-3
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

nginx

vulnerable target service

The nginx service is built from source (version 1.27.4) with debug symbols. It runs with a custom nginx.conf that contains the vulnerable map/location pattern for CVE-2026-42533. It listens on port 8080, has SYS_PTRACE capability and seccomp:unconfined for GDB debugging, and mounts the exploit directory as read-only.

docker-compose.yml:5-17Dockerfile:5-62nginx/nginx.conf:1-99

exploit.py

full exploit chain script

A Python script that implements the full exploit chain for CVE-2026-42533: info leak, heap spray, and heap overflow to achieve RCE. It targets the nginx service inside the container and includes options for leak-only, crash, and reverse shell.

exploit/exploit.py:1-610

leak.py

info leak module

A Python script that exploits the info leak primitive of CVE-2026-42533 to leak heap and libc pointers from the vulnerable nginx server.

exploit/leak.py:1-211

overflow.py

heap overflow module

A Python script that demonstrates and triggers the heap overflow primitive of CVE-2026-42533, including diagnostic mode, crash PoC, heap spray, and RCE framework.

exploit/overflow.py:1-358

analyze.py

GDB analysis helper

A Python script that generates a GDB script for analyzing the heap layout and determining offsets needed for the exploit. It is intended to be run inside the container.

exploit/analyze.py:1-110

nginx.conf

vulnerable nginx configuration

The nginx configuration file that sets up the vulnerable map and location directives to trigger the two-pass capture clobbering vulnerability. It defines endpoints for info leak (/leak/) and heap overflow (/api/, /x/, /proxy/, /named/).

nginx/nginx.conf:1-99
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-42533

Supported by supplied evidence

The entire environment is built around CVE-2026-42533. The README, Dockerfile, nginx.conf, and all exploit scripts explicitly reference this CVE. The nginx version (1.27.4) falls within the affected range (0.9.6–1.30.3) stated in the README. The configuration contains the exact vulnerable pattern described (regex map with numbered capture used in a location with a two-pass sink).

README.md:1README.md:11-13Dockerfile:1-3nginx/nginx.conf:1-99
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host to build and run the environment.README.md:131-133
  • Python 3.8+ with requests, urllib3, and pwntools installed (either on the host or inside the container) to run the exploit scripts.exploit/requirements.txt:1-3README.md:97-99
  • The nginx service must be running with the provided vulnerable nginx.conf.docker-compose.yml:5-17nginx/nginx.conf:1-99

Evidence-described exercise path

  1. Build and start the vulnerable nginx container using 'docker compose up -d --build'.README.md:131-133
  2. Verify the vulnerability by running the diagnostic mode: 'python3 exploit/overflow.py localhost --port 8080 --diagnose'.README.md:103-105
  3. Optionally, crash the worker to prove exploitability: 'python3 exploit/overflow.py localhost --port 8080 --crash'.README.md:109-111
  4. Run the full exploit chain: 'python3 exploit/exploit.py localhost' to perform info leak, heap spray, and overflow to achieve RCE.README.md:139-141
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the vulnerable nginx target inside the container. The exploit scripts target the lab's own nginx service on localhost:8080. The Dockerfile and compose file do not contain any hidden or unnecessary host escape mechanisms. The SYS_PTRACE capability and seccomp:unconfined are explicitly justified for GDB debugging. No evidence of credential theft, data destruction, persistence, or external connectivity beyond the lab target.

docker-compose.yml:11-13exploit/exploit.py:1-610exploit/leak.py:1-211exploit/overflow.py:1-358
Review boundaries

What the analysis did not establish

  • The packet does not include the actual nginx source code or binary; the vulnerability is assumed based on the version and configuration.
  • The exploit scripts contain hardcoded offsets and addresses that may not match the built binary without GDB analysis, so the exercise path may require adjustment.
  • The README mentions a 'confirmed working' table with partial info leak on Ubuntu 24.04, indicating the exploit may not be fully reliable in this environment without manual tuning.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1