friparia/nginx_rift_scan_cve_2026_42945

This is a Python script that scans an NGINX web server's configuration for a specific security vulnerability, CVE-2026-42945, nicknamed NGINX Rift. NGINX is widely used software for serving websites and acting as a reverse proxy, a gateway that routes internet traffic to backend services. The vulnerability involves a particular combination of NGINX configuration directives. When a rewrite rule, which rewrites a URL path, includes a question mark character in the replacement string, and a later directive in the same block references an unnamed pattern capture variable like $1 or $2, a mismatch between how the script engine counts string lengths and how it copies memory can cause a heap buffer overflow, a type of security bug that can allow remote code execution, meaning an attacker running arbitrary commands on the server. The scanner works by running the nginx -T command to dump the full active configuration and then statically checking it for this risky pattern. It reports whether the installed NGINX version falls in the affected range, whether the vulnerable configuration sequence was found, and what action to take. If the pattern is detected, it shows the exact location and surrounding context lines. You run it with a single command, python3 scan_rift.py, adding sudo if elevated permissions are needed to read the configuration. You can also point it at a previously exported configuration file instead of scanning live. The README notes this is a configuration scanner, not an exploit tool. It can produce false positives and should be followed by manual review. It is written in Python, and the README is in Chinese with an English version linked.