Nginx UI CVE 2026 33032 Module

[Aarush289]

Proposed change

Adds a detection module for CVE-2026-33032 affecting Nginx UI. The module identifies unauthenticated access to the /mcp_message endpoint by verifying the JSON-RPC response indicative of the vulnerable behavior.
Fixes #1519
Tested against local instance of vulnerable and patched versions

Type of change

• New core framework functionality
• Bugfix (non-breaking change that fixes an issue)
• Code refactoring without any functionality changes
• New or existing module/payload change
• Documentation/localization improvement
• Test coverage improvement
• Dependency upgrade
• Other improvement (best practice, cleanup, optimization, etc)

Checklist

• I've followed the contributing guidelines
• I've digitally signed all my commits in this PR
• I've run make pre-commit and confirm it didn't generate any warnings/changes
• I've run make test and I confirm all tests passed locally
• I've added/updated any relevant documentation in the docs/ folder
• I've linked this PR with an open issue
• I've tested and verified that my code works as intended and resolves the issue as described
• I've attached screenshots demonstrating that my code works as intended (if applicable)
• I've checked all other open PRs to avoid submitting duplicate work
• I confirm that the code and comments in this PR are not direct unreviewed outputs of AI
• I confirm that I am the Sole Responsible Author for every line of code, comment, and design decision

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b867cfe4-4401-4ddb-87d9-ff247299537b

📥 Commits

Reviewing files that changed from the base of the PR and between a7f4604 and 61a6de4.

📒 Files selected for processing (1)

• docs/Modules.md

🚧 Files skipped from review as they are similar to previous changes (1)

• docs/Modules.md

---

Summary by CodeRabbit

• New Features
  • Added a new vulnerability check for Nginx UI related to unauthenticated MCP endpoint exposure (CVE-2026-33032).
  • Expanded the vulnerability module catalog with the new detection entry so it’s discoverable and runnable from the modules list.

Walkthrough

Adds a Nettacker vulnerability module for detecting unauthenticated Nginx UI MCP endpoint exposure (CVE-2026-33032), with a corresponding entry in the module documentation.

Changes

Nginx UI CVE-2026-33032 Module

Layer / File(s)	Summary
Module metadata and HTTP detection logic nettacker/modules/vuln/nginx_ui_cve_2026_33032.yaml, docs/Modules.md	Adds module metadata, an unauthenticated JSON-RPC POST to /mcp_message, response matching for HTTP 400 JSON-RPC responses, and the documentation entry.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested labels: new module

Suggested reviewers: securestep9

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly names the Nginx UI CVE-2026-33032 module, which matches the main change.
Description check	✅ Passed	The description describes adding a detection module for CVE-2026-33032 and is aligned with the changeset.
Linked Issues check	✅ Passed	The PR adds a module for CVE-2026-33032 and detects unauthenticated /mcp_message access as requested in #1519.
Out of Scope Changes check	✅ Passed	The only changes are the new module and its docs entry, with no unrelated scope visible.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@nettacker/modules/vuln/nginx_ui_cve_2026_33032.yaml`:
- Around line 78-80: The matcher in the nginx_ui_cve_2026_33032.yaml template is
too generic and can flag any JSON-RPC 400 response as vulnerable. Update the
regex under the vuln check to anchor on the unauthenticated-path/error text
specific to the exploit path instead of only matching “jsonrpc”, “message”, and
“id”, and keep the change scoped to the existing content matcher so the module
reduces false positives.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: cf338451-d1df-4a6d-bf8b-667315c567be

📥 Commits

Reviewing files that changed from the base of the PR and between ef0c6b0 and a7f4604.

📒 Files selected for processing (2)

• docs/Modules.md
• nettacker/modules/vuln/nginx_ui_cve_2026_33032.yaml

[securestep9]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 44b0b8eb66

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Require the missing-session error in the match

When any non-nginx-ui JSON-RPC/MCP service happens to expose /mcp_message and returns a normal 400 JSON-RPC error, this condition will still pass because it only requires jsonrpc, message, and id somewhere in the body. That can report CVE-2026-33032 for unrelated services; the probe description says it is looking for the missing-session response, so the content check should include that specific error text or another nginx-ui-specific fingerprint.

Useful? React with 👍 / 👎.

[Aarush289]

The probe already fingerprints the target using the specific /mcp_message endpoint and a valid MCP JSON-RPC request. Requiring an exact error string would lead to false negatives, as response messages may change across versions.