The POC disables aslr: https://github.com/DepthFirstDisclosures/Nginx-Rift/blob/mai...
New Nginx Exploit
11–20 of 116 posts
Re: New Nginx Exploit
#12This one's pretty bad but there are some preconditions. Requires a "rewrite" directive with a questionmark in the replacement string, and then a subsequent "set" directive that references a regex capture group (e.g. set $var $1). Also the POC assumes ASLR is disabled.
Does any distro disable ASLR by default?
If you were to do it by hand, nginx doesn't come to mind as a likely candidate.
Re: New Nginx Exploit
#13This one's pretty bad but there are some preconditions. Requires a "rewrite" directive with a questionmark in the replacement string, and then a subsequent "set" directive that references a regex capture group (e.g. set $var $1). Also the POC assumes ASLR is disabled.
Re: New Nginx Exploit
#14Wow, coming from the webdev world. It is so funny seeing NGINX, one of the widest used web servers in the world, on version 1.x. React is on version 19. Really shows how differently new vs. old software is designed and built, and not necessarily in a good way. https://world.hey.com/dhh/finished-software-8ee43637 https://josem.co/the-beauty-of-finished-software/
I guess someone need to update https://0ver.org/ then.
Re: New Nginx Exploit
#15Wow, coming from the webdev world. It is so funny seeing NGINX, one of the widest used web servers in the world, on version 1.x. React is on version 19. Really shows how differently new vs. old software is designed and built, and not necessarily in a good way. https://world.hey.com/dhh/finished-software-8ee43637 https://josem.co/the-beauty-of-finished-software/
> not necessarily in a good way
How do you think versioning works? You know that it's completely arbitrary and up to the author, right? Very ironic comment.
Re: New Nginx Exploit
#16[deleted]
Re: New Nginx Exploit
#17Wow, coming from the webdev world. It is so funny seeing NGINX, one of the widest used web servers in the world, on version 1.x. React is on version 19. Really shows how differently new vs. old software is designed and built, and not necessarily in a good way. https://world.hey.com/dhh/finished-software-8ee43637 https://josem.co/the-beauty-of-finished-software/
That's because nginx doesn't break things for end user every release, so there is no reason to bump major version.
Re: New Nginx Exploit
#18Re: New Nginx Exploit
#19Wow, coming from the webdev world. It is so funny seeing NGINX, one of the widest used web servers in the world, on version 1.x. React is on version 19. Really shows how differently new vs. old software is designed and built, and not necessarily in a good way. https://world.hey.com/dhh/finished-software-8ee43637 https://josem.co/the-beauty-of-finished-software/
anyone can choose any version string convention they want for their project. Comparing two different pieces of software by their version string doesn't make sense.
Re: New Nginx Exploit
#20Wow, coming from the webdev world. It is so funny seeing NGINX, one of the widest used web servers in the world, on version 1.x. React is on version 19. Really shows how differently new vs. old software is designed and built, and not necessarily in a good way. https://world.hey.com/dhh/finished-software-8ee43637 https://josem.co/the-beauty-of-finished-software/
> not necessarily in a good way How do you think versioning works? You know that it's completely arbitrary and up to the author, right? Very ironic comment.
[deleted]