nginx 1.30.x < 1.30.6 / 1.31.2 < 1.31.7 Heap Buffer Overflow

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(371394);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/23");

  script_cve_id("CVE-2026-93479");
  script_xref(name:"IAVA", value:"2026-A-1142");

  script_name(english:"nginx 1.30.x < 1.30.6 / 1.31.2 < 1.31.7 Heap Buffer Overflow");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its Server response header, the installed version of nginx is 1.30.0 prior to 1.30.6, or 1.31.2 prior to
1.31.7. It is, therefore, affected by the following issue:

  - A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and
    the root directive or access log format references the map's regex capture variables before referencing
    the map output variable. Alternatively, the same result could be achieved by using a non-cacheable
    variable in a string expression under certain conditions. An unauthenticated attacker along with
    conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may
    cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can
    execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can
    bypass ASLR. There is no control plane exposure; this is a data plane issue only. Note: Software versions
    which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-93479)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://my.f5.com/manage/s/article/K000162607");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-93479");
  script_set_attribute(attribute:"solution", value:
"Upgrade to nginx 1.30.6, 1.31.7 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-93479");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/23");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:nginx:nginx");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nginx_detect.nasl", "nginx_nix_installed.nbin");
  script_require_keys("Settings/ParanoidReport", "installed_sw/nginx");

  exit(0);
}

include('vcf.inc');
include('http.inc');

# requires a map directive with regex captures referenced before the map output variable
if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var appname = 'nginx';
get_install_count(app_name:appname, exit_if_zero:TRUE);

var app_info = vcf::combined_get_app_info(app:appname);
vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  { 'min_version' : '1.30.0', 'fixed_version' : '1.30.6' },
  { 'min_version' : '1.31.2', 'fixed_version' : '1.31.7' }
];
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);