Exposed, outdated nginx server (v1.4.6) potentially vulnerable to heap-based buffer overflow & RCE
该报告还没有中文解读。
原文摘录
摘自原文（2115 字符中的一小部分）
Summary ======== During my reconnaissance for your bug bounty program, I discovered an instance of nginx version 1.4.6 running at the IP address https://54.153.101.52. To locate it, I search for IRCCloud-related certificated and found the self-signed certificate for this server …
原文中的代码
--- src/http/ngx_http_spdy.c
+++ src/http/ngx_http_spdy.c
@@ -1849,7 +1849,7 @@ static u_char *
ngx_http_spdy_state_save(ngx_http_spdy_connection_t *sc,
u_char *pos, u_char *end, ngx_http_spdy_handler_pt handler)
{
-#if (NGX_DEBUG)
+#if 1
if (end - pos > NGX_SPDY_STATE_BUFFER_SIZE) { …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 IRCCloud 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @cha5m · 版权归作者与 IRCCloud 所有