Vulnerability · Published Jan 11, 2024 · Assigned by GitHub_M
CVE-2024-22197Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)
High 7.7
In plain English
A high-severity command injection in nginx-ui from 0xJacky. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Nginx-ui is online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. The `Home > Preference` page exposes a small list of nginx settings such as `Nginx Access Log Path` and `Nginx Error Log Path`. However, the API also exposes `test_config_cmd`, `reload_cmd` and `restart_cmd`. While the UI doesn't allow users to modify any of these settings, it is possible to do so by sending a request to the API. This issue may lead to authenticated Remote Code Execution, Privilege Escalation, and Information Disclosure. This issue has been patched in version 2.0.0.beta.9.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/0xJacky/Nginx-UI | 1.9.10-0.20231219184941-827e76c46e63 | GHSA-pxmr-q2x3-9x9m |
| Go | github.com/0xJacky/Nginx-UI | 1.9.10-0.20231219184941-827e76c46e63 | GO-2024-2464 |
Affected products (as reported)
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L