NGINX Plus/Open Source map directive heap buffer overflow via regex capture in root/access_log evaluation

#!/usr/bin/env bash
# check_cve_2026_93479.sh — Detect CVE-2026-93479 exposure
# Checks NGINX version + configuration for vulnerable pattern
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -euo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'

# --- Step 1: Find NGINX binary ---
NGINX_BIN=$(command -v nginx 2>/dev/null || echo "")
if [[ -z "$NGINX_BIN" ]]; then
  echo -e "${YELLOW}[UNKNOWN]${NC} nginx binary not found in PATH."
  exit 2
fi

# --- Step 2: Extract version ---
VERSION_RAW=$($NGINX_BIN -v 2>&1 | grep -oP 'nginx/\K[0-9]+\.[0-9]+\.[0-9]+')
if [[ -z "$VERSION_RAW" ]]; then
  echo -e "${YELLOW}[UNKNOWN]${NC} Could not parse nginx version."
  exit 2
fi
echo "Detected NGINX version: $VERSION_RAW"

# --- Step 3: Version comparison ---
version_gte() {
  printf '%s\n%s' "$1" "$2" | sort -V | head -n1 | grep -qx "$2"
}
version_gt() {
  [[ "$1" != "$2" ]] && version_gte "$1" "$2"
}

VULN_VERSION=false
# Stable branch: 1.30.0 <= v <= 1.30.5
if version_gte "$VERSION_RAW" "1.30.0" && ! version_gt "$VERSION_RAW" "1.30.5"; then
  VULN_VERSION=true
  echo "Version $VERSION_RAW is in vulnerable stable range (1.30.0-1.30.5)."
fi
# Mainline branch: 1.31.2 <= v <= 1.31.6
if version_gte "$VERSION_RAW" "1.31.2" && ! version_gt "$VERSION_RAW" "1.31.6"; then
  VULN_VERSION=true
  echo "Version $VERSION_RAW is in vulnerable mainline range (1.31.2-1.31.6)."
fi

if [[ "$VULN_VERSION" == false ]]; then
  echo -e "${GREEN}[PATCHED]${NC} NGINX $VERSION_RAW is outside the vulnerable range."
  exit 0
fi

# --- Step 4: Check configuration for vulnerable pattern ---
echo "Scanning NGINX configuration for vulnerable map-regex pattern..."
CONF_FILE=$($NGINX_BIN -T 2>/dev/null) || {
  echo -e "${YELLOW}[UNKNOWN]${NC} Cannot dump NGINX config (run as root?)."
  echo -e "${RED}[VULNERABLE]${NC} Version is in affected range but config check failed."
  exit 1
}

# Look for map blocks with regex (~) that have capture groups
MAP_REGEX=$(echo "$CONF_FILE" | grep -cP '^\s*map\s+.*~' 2>/dev/null || echo "0")
if [[ "$MAP_REGEX" -eq 0 ]]; then
  echo "No map directives with regex matching found in active config."
  echo -e "${GREEN}[PATCHED]${NC} Version is vulnerable but config does not use map-regex. Low risk."
  # Still report as vulnerable since a config change could introduce the pattern
  echo "(Note: version is still in affected range — upgrade recommended.)"
  exit 0
fi

# Check if root or access_log references numbered captures ($1, $2, etc.)
ROOT_CAPTURE=$(echo "$CONF_FILE" | grep -cP '^\s*(root|access_log)\s+.*\$[0-9]+' 2>/dev/null || echo "0")
if [[ "$ROOT_CAPTURE" -gt 0 ]]; then
  echo -e "${RED}[VULNERABLE]${NC} NGINX $VERSION_RAW with map-regex AND root/access_log"
  echo "  referencing numbered capture variables (\$1, \$2, etc.)."
  echo "  This matches the CVE-2026-93479 trigger pattern."
  echo "  ACTION: Patch immediately or rewrite captures to named variables."
  exit 1
else
  echo "Map-regex found but root/access_log does not reference numbered captures."
  echo -e "${YELLOW}[VULNERABLE]${NC} Version in affected range. Config appears safe but"
  echo "  upgrade to 1.30.6+/1.31.7+ is still recommended as a defense-in-depth measure."
  exit 1
fi