PT-2023-8394 · Nginx-Ui · Nginx-Ui

Jorgectf · Publicado 2023-12-19 · Atualizado 2024-02-08 · CVE-2024-22198

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nginx-UI versions prior to 2.0.0.beta.9

Description The issue concerns arbitrary command execution by abusing configuration settings in Nginx-UI, a web interface for managing Nginx configurations. The Home > Preference page exposes system settings such as Run Mode, Jwt Secret, Node Secret, and Terminal Start Command. Although the UI does not allow modification of the Terminal Start Command setting, it is possible to modify it by sending a request to the API. This can lead to authenticated remote code execution, privilege escalation, and information disclosure.

Recommendations For versions prior to 2.0.0.beta.9, update to version 2.0.0.beta.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the Terminal Start Command setting and limiting the ability to send requests to the API that could modify this setting. Additionally, restrict access to the Home > Preference page to minimize the risk of exploitation.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2024-00625

CVE-2024-22198

GHSA-8R25-68WM-JW35

GO-2024-2462

Produtos afetados

Nginx-Ui

Referências · 18

• 🔥 https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22198.json · Exploit
• https://github.com/0xJacky/nginx-ui · Nota
• https://github.com/0xJacky/nginx-ui/commit/827e76c46e63c52114a62a899f61313039c754e3 · Correção
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/router/middleware.go#L45 · Nota
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/api/terminal/pty.go#L11 · Nota
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/settings/server.go#L12 · Nota
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/internal/pty/pipeline.go#L29 · Nota
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/api/system/settings.go#L18 · Nota
• https://osv.dev/vulnerability/CVE-2024-22198 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2024-22198 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-8r25-68wm-jw35 · Aviso do Fabricante
• https://t.me/cvenotify/70536 · Publicação no Telegram
• https://github.com/advisories/GHSA-8r25-68wm-jw35 · Nota
• https://twitter.com/CVEnew/status/1745534140147962294 · Publicação no Twitter