PT-2026-29091 · Alibaba+5 · Alibaba Cloud Dns+5

F1Vet · Publicado 2026-03-30 · Atualizado 2026-04-15 · CVE-2026-33030

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Nginx-UI and Affected Versions Nginx-UI versions 2.3.3 and prior

Description Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application's base Model struct lacks a user id field, and all resource endpoints perform queries by ID without verifying user ownership, enabling complete authorization bypass in multi-user environments. The dns.Config structure contains API credentials, including CF API TOKEN for Cloudflare, ALICLOUD ACCESS KEY and ALICLOUD SECRET KEY for Alibaba Cloud DNS, TENCENTCLOUD SECRET ID and TENCENTCLOUD SECRET KEY for Tencent Cloud DNS, AWS ACCESS KEY ID and AWS SECRET ACCESS KEY for AWS Route53, and GODADDY API KEY and GODADDY API SECRET for GoDaddy. The combination of the IDOR vulnerability and plaintext storage of these credentials allows attackers to extract API tokens from other users' resources, potentially leading to DNS record modification, fraudulent SSL certificate issuance, and pivoting to cloud infrastructure. The application's base Model struct lacks a user id field, and all resource endpoints perform queries by ID without verifying user ownership, enabling complete authorization bypass in multi-user environments.

Recommendations Versions prior to and including 2.3.3: Add a user id field to the base Model struct. Filter queries by the current user's ID. Add authorization middleware to verify resource ownership. Migrate existing data to include the user id and encrypt sensitive fields like DNS and ACME data using AES encryption.

Exploit

Correção

OS Command Injection

IDOR

Enumeração de Fraquezas

CWE-78

CWE-639

Identificadores relacionados

BDU:2026-04702

CVE-2026-33030

GHSA-5HF2-VHJ6-GJ9M

GO-2026-4901

SUSE-SU-2026:1205-1

Produtos afetados

Aws Route53

Alibaba Cloud Dns

Cloudflared

Godaddy

Nginx-Ui

Tencent Cloud Dns

Referências · 49

• 🔥 https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5hf2-vhj6-gj9m · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33030.json · Exploit
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 · Nota
• https://github.com/0xJacky/nginx-ui · Nota
• https://suse.com/security/cve/CVE-2026-33747 · Nota
• https://suse.com/security/cve/CVE-2026-29180 · Nota
• https://suse.com/security/cve/CVE-2026-26060 · Nota
• https://suse.com/security/cve/CVE-2026-26233 · Nota
• https://suse.com/security/cve/CVE-2026-32241 · Nota
• https://suse.com/security/cve/CVE-2026-33990 · Nota
• https://suse.com/support/update/announcement/2026/suse-su-20261205-1 · Nota
• https://suse.com/security/cve/CVE-2026-33026 · Nota
• https://suse.com/security/cve/CVE-2026-26061 · Nota
• https://suse.com/security/cve/CVE-2026-33186 · Nota
• https://suse.com/security/cve/CVE-2026-34386 · Nota