PT-2023-8394 · Nginx-Ui · Nginx-Ui

Jorgectf · Published 2023-12-19 · Updated 2024-02-08 · CVE-2024-22198

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nginx-UI versions prior to 2.0.0.beta.9

Description The issue concerns arbitrary command execution by abusing configuration settings in Nginx-UI, a web interface for managing Nginx configurations. The Home > Preference page exposes system settings such as Run Mode, Jwt Secret, Node Secret, and Terminal Start Command. Although the UI does not allow modification of the Terminal Start Command setting, it is possible to modify it by sending a request to the API. This can lead to authenticated remote code execution, privilege escalation, and information disclosure.

Recommendations For versions prior to 2.0.0.beta.9, update to version 2.0.0.beta.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the Terminal Start Command setting and limiting the ability to send requests to the API that could modify this setting. Additionally, restrict access to the Home > Preference page to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-00625

CVE-2024-22198

GHSA-8R25-68WM-JW35

GO-2024-2462

Affected Products

Nginx-Ui

References · 18

• 🔥 https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22198.json · Exploit
• https://github.com/0xJacky/nginx-ui/commit/827e76c46e63c52114a62a899f61313039c754e3 · Patch
• https://osv.dev/vulnerability/CVE-2024-22198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22198 · Security Note
• https://osv.dev/vulnerability/GHSA-8r25-68wm-jw35 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2462 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00625 · Security Note
• https://github.com/0xJacky/nginx-ui · Note
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/router/middleware.go#L45 · Note
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/api/terminal/pty.go#L11 · Note
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/settings/server.go#L12 · Note
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/internal/pty/pipeline.go#L29 · Note
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/api/system/settings.go#L18 · Note
• https://t.me/cvenotify/70536 · Telegram Post