CVE-2026-42533-Config-Scanner - Static config scanner that flags nginx configs vul

项目说明

nginx capture-clobber scanner

A read-only static scanner that flags nginx configurations to the
complex_value two-pass capture-clobbering bug class (F5/nginx SIRT ad,
July 2026). It parses your config and reports the pattern with the
reason and location. It does not exploit anything and does not touch the running
server.

Single file, standard library only, Python 3.6+.

Full write-up of the :

The bug

nginx builds many directi in two passes. A LEN pass measures the length
and allocates a buffer, then a VALUE pass writes into it. Regex captures ($1
to $9, or named (?P<name>...)) are read from per-request shared state. A
map whose match key is a regular expression runs a fresh PCRE match the moment
its is e, and that match o the shared capture state.
If a capture is measured in the LEN pass and then a regex map runs before the
VALUE pass rewrites that capture, the two passes disagree:

clobber makes the value longer than measured: heap buffer o

(attacker-controlled out-of-bounds write)

clobber makes the value shorter than measured: uninitialised heap returned to

the client (info leak of libc/heap pointers)

Both directions are remotely triggerable when the map input is
attacker-influenced ($request_body, $http_*, $arg_*, $uri,
$ssl_preread_ser, and so on).

What counts as

The scanner flags a location or server when all of these land in one two-pass
buffer, in the exploitable order:

1. Capture source: a regex location ~, ser ~, rewrite,
if (... ~ ...), or a regex map with a capture group.
2. Clobber trigger: a map (http or stream) with a ~ or ~* regex match key,
referenced by its output .
3. Two-pass sink using both a capture ref and the regex-map :
- single-value directives (return, set, add_header, proxy_method,
proxy_pass, rewrite, index, and others): both refs in the same value.
- the param/header families (proxy_set_header, proxy_set_body,
fastcgi_param, scgi_param, uwsgi_param, grpc_set_header): these
build one buffer per request for the whole family, so the two refs can be
in separate directives in the same location.
4. Order: the capture must be e before the regex map. A regex map runs
once and caches, so map-before-capture reads a consistent state and is not
. The scanner reports those as cleared (safe but fragile, do not
reorder).

Usage

Options

| Option | Effect |
|-----------------|---------------------------------------|
| --json | Emit a JSON report instead of text. |
| --no-includes | Do not follow include directives. |

Exit codes

| Code | Meaning |
|------|----------------------------------------------|
| 0 | No configuration found. |
| 1 | At least one configuration found. |
| 2 | Usage error (no path given, or none found). |

Usable in CI, since a config exits non-zero:

Output

Text mode prints, for each finding: file and line, the enclosing scope, the sink
directive, the capture and map in, the triggering map, and a
one-line reason. A cleared section lists safe-order coexistences. --json
produces:

Fixing what it finds

1. Apply the patch (nginx 1.30.4 stable / 1.31.3 mainline, NGINX Plus R36 P7 / 37.0.3.1). This is the only complete fix. The patch adds a boundary guard (ngx_http_script_check_length()) that prevents the VALUE pass from writing past the allocated buffer, and computes the returned string length from bytes actually written rather than the LEN-pass measurement, closing both the o and the info-leak directions.
2. Interim config hardening (defence in depth, not a substitute for the patch):
- Do not reference a regex map in the same location or buffer as a
$1 to $9 or named-capture reference.
- Do not reuse the same (?P<name>...) group across multiple regex maps.
- Keep capture refs and regex-map refs out of the same proxy_set_header or
fastcgi_param family.

Limitations

Static analysis: it reads config, not runtime behaviour. It cannot resolve

produced by dynamically set .

Unreadable include targets (for example absolute paths that do not exist

locally) are reported under missing_includes, not silently skipped. Run it
on the host where the config resolves for full co.

A flagged capture-before-map hit can be defused at runtime if that map

was already e earlier in the same request (it would already
be cached). The scanner still reports these, which is the conser choice
for a security self-scan.

Reference

write-up and exploit chain:

项目信息

开发语言：Python

Star 数：30

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Static config scanner that flags nginx configs vulnerable to the complex_value two-pass capture-clobbering bug (regex map + regex capture → heap overflow / info leak).展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。