nginx 0.1.29 < 1.30.6 / 1.31.x < 1.31.7 Buffer Overflow Vulnerability

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(371115);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/23");

  script_cve_id("CVE-2026-15176");
  script_xref(name:"IAVA", value:"2026-A-1142");

  script_name(english:"nginx 0.1.29 < 1.30.6 / 1.31.x < 1.31.7 Buffer Overflow Vulnerability");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its Server response header, the installed version of nginx is 0.1.29 prior to 1.30.6 or 1.31.0 prior to
1.31.7. It is, therefore, affected by the following issue :

  - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the
    alias directive together with rewrite and a set or return directive referencing the $request_filename
    variable. Alternatively, the same result could be achieved when the $request_filename variable is used in
    an access log format directive. An unauthenticated attacker along with conditions beyond their control can
    exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the
    NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with
    Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This
    vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to
    possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-15176)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://my.f5.com/manage/s/article/K000162416");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-15176");
  script_set_attribute(attribute:"solution", value:
"Upgrade to nginx 1.30.6, 1.31.7 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-15176");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/23");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:nginx:nginx");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nginx_detect.nasl", "nginx_nix_installed.nbin");
  script_require_keys("Settings/ParanoidReport", "installed_sw/nginx");

  exit(0);
}

include('vcf.inc');
include('http.inc');

# ngx_http_core_module requires specific configuration
# (alias directive in location block and/or $request_filename variable usage)
if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var appname = 'nginx';
get_install_count(app_name:appname, exit_if_zero:TRUE);

var app_info = vcf::combined_get_app_info(app:appname);
vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  { 'min_version' : '0.1.29', 'fixed_version' : '1.30.6' },
  { 'min_version' : '1.31.0', 'fixed_version' : '1.31.7' }
];
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);