hamid-k/nginx-rift-private-lab

This repository is a private security research lab built around CVE-2026-42945, a critical vulnerability in the NGINX web server that was present in the codebase since 2008. The bug is a heap buffer overflow in the module that handles URL rewriting. An attacker can send a specially crafted HTTP request to a vulnerable server and, under the right conditions, execute arbitrary commands on that server without needing to log in. The technical cause is a mismatch between two passes in NGINX's script engine. The first pass calculates how much memory to allocate for a rewritten URL, and the second pass copies the data into that allocation. Because of a flag that only gets set during the copy pass, the copy writes more bytes than the allocation reserved, overflowing the heap buffer with content the attacker controls. The core proof-of-concept code came from the original CVE disclosure, produced by a security analysis tool called depthfirst. This fork extends that work with a more realistic attack chain that functions against servers where address space layout randomization is enabled. ASLR is a standard Linux security feature that randomizes memory locations to make exploits harder to write. The extended chain gets around ASLR by using a second vulnerability: a PHP local file read primitive on the same server. That flaw lets the researcher read files from the server's filesystem, including internal Linux process files that reveal where the NGINX worker process is loaded in memory. Once those addresses are known, the exploit can target the exact memory location it needs. The README carefully documents what conditions must be true for the exploit to work, including that PHP must be able to read certain process files and that HTTP/2 must be enabled. It is explicit that these are controlled lab conditions, not universal assumptions about real production servers. The vendor advisory and fixed versions are listed. NGINX Open Source versions 0.6.27 through 1.30.0 are affected, 1.31.0 and 1.30.1 contain the fix.