Log in Start free

Vulnerability · Published Jan 11, 2024 · Assigned by GitHub_M

CVE-2024-22198Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)

High 7.1

In plain English

A high-severity command injection in nginx-ui from 0xJacky. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.1% (higher than 91% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)4.1%top 9.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings. The `Home > Preference` page exposes a list of system settings such as `Run Mode`, `Jwt Secret`, `Node Secret` and `Terminal Start Command`. While the UI doesn't allow users to modify the `Terminal Start Command` setting, it is possible to do so by sending a request to the API. This issue may lead to authenticated remote code execution, privilege escalation, and information disclosure. This vulnerability has been patched in version 2.0.0.beta.9.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/0xJacky/Nginx-UI1.9.10-0.20231219184941-827e76c46e63GHSA-8r25-68wm-jw35
Gogithub.com/0xJacky/Nginx-UI1.9.10-0.20231219184941-827e76c46e63GO-2024-2462

Affected products (as reported)

VendorProductVersions
0xJacky nginx-ui < 2.0.0.beta.9

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

References