utspark/nginx-cve-2017-7529 repository overview

Two versions:

• vuln: Uses a version of nginx which is vulnerable to CVE-2017-7529.
• notvuln: Uses nginx which is not vulnerable to CVE-2017-7529

Both containers host a PNG file necessary for the exploit at http:///demo/demo.png

Here is a link to the exploit script: https://bitbucket.org/rjw245/rddr/src/master/deployments/nginx-cve-2017-7529/CVE-2017-7529-exploit.py⁠

Simply point it at the hosted PNG:

python CVE-2017-7529-exploit.py http://<hostname>/demo/demo.png