Nginx UI CVE 2026 33032 Module

docs/Modules.md

@@ -222,6 +222,7 @@ If you want to scan all ports please define -g 1-65535 range. Otherwise Nettacke
 - '**msexchange_cve_2021_26855_vuln**' – check the target for MS Exchange SSRF CVE-2021-26855
 - '**msexchange_cve_2021_34473_vuln**' – check the target for MS Exchange CVE-2021-34473 vulnerability
 - '**novnc_cve_2021_3654_vuln**' – check the target for noVNC CVE-2021-3654 vulnerability
+- '**nginx_ui_cve_2026_33032_vuln**' – check unauthenticated MCP endpoint exposure vulnerability CVE-2026-33032
 - '**omigod_cve_2021_38647_vuln**' – check the target for OMIGOD CVE-2021-38647 vulnerability
 - '**paloalto_globalprotect_cve_2025_0133_vuln**' – check the target for PaloAlto GlobalProtect CVE-2025-0133 XSS vulnerability
 - '**paloalto_panos_cve_2025_0108_vuln**' – check the target for PaloAlto PAN-OS CVE-2025-0108 vulnerability

nettacker/modules/vuln/nginx_ui_cve_2026_33032.yaml

@@ -0,0 +1,80 @@
+info:
+  name: nginx_ui_cve_2026_33032_vuln
+  author: Nettacker Team
+  severity: 9.8
+  description: |
+    Detects a Broken Access Control vulnerability in Nginx UI versions prior
+    to 2.3.4. The `/mcp_message` endpoint processes unauthenticated JSON-RPC
+    requests and returns a JSON-RPC error indicating a missing session ID
+    instead of rejecting the request with an authentication error. Successful
+    detection indicates the endpoint is reachable without authentication and
+    is likely vulnerable to CVE-2026-33032.
+  references:
+    - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h6c2-x2m2-mwhf
+    - https://github.com/0xJacky/nginx-ui/commit/413dc631
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-33032
+  profiles:
+    - vuln
+    - http
+    - cve
+    - cve2026
+    - nginx_ui
+    - mcp
+    - unauth
+    - critical_severity
+
+payloads:
+  - library: http
+    steps:
+      - method: post
+        timeout: 5
+        headers:
+          User-Agent: "{user_agent}"
+          Content-Type: "application/json"
+        ssl: false
+        allow_redirects: false
+        url:
+          nettacker_fuzzer:
+            input_format: "{{schema}}://{target}:{{ports}}/mcp_message"
+            prefix: ""
+            suffix: ""
+            interceptors:
+            data:
+              schema:
+                - "http"
+                - "https"
+              ports:
+                - 80
+                - 443
+                - 9000
+
+        data: |
+          {{
+            "jsonrpc":"2.0",
+            "method":"initialize",
+            "params":{{
+              "protocolVersion":"2024-11-05",
+              "capabilities":{{}},
+              "clientInfo":{{
+                "name":"nettacker",
+                "version":"1.0"
+              }}
+            }},
+            "id":1
+          }}
+
+        response:
+          condition_type: and
+          conditions:
+            status_code:
+              regex: "400"
+              reverse: false
+
+            headers:
+              Content-Type:
+                regex: "application/json"
+                reverse: false
+
+            content:
+              regex: '(?s)(?=.*"jsonrpc":)(?=.*"message")(?=.*"id").*'
+              reverse: false