| शीर्षक | cym1102 nginxWebUI 4.4.2 Code Injection |
|---|
| विवरण | An issue was discovered in nginxWebUI 4.4.2. The `/adminPage/main/autoUpdate` endpoint accepts a user-controllable `url` parameter and downloads a JAR package from that location without validating the source. The downloaded file is then executed by the application using `java -jar`, which leads to remote code execution on the server.
The vulnerable code path is `MainController.autoUpdate`, which calls `HttpUtil.downloadFile(...)` to fetch the provided URL and then passes the downloaded file to `UpdateUtils.run(...)`. The endpoint is reachable by an authenticated administrator session and also via the application’s token/creditKey mechanism. An attacker who can influence the `url` parameter can force the server to fetch and execute an attacker-controlled JAR, causing arbitrary Java code execution as the application user.
The root cause is the combination of arbitrary URL fetch, lack of source validation or signature checks, and direct execution of the downloaded package. |
|---|
| स्रोत | ⚠️ https://github.com/cym1102/nginxWebUI/issues/213 |
|---|
| उपयोगकर्ता | lem0n817 (UID 84709) |
|---|
| सबमिशन | 02/08/2026 04:29 PM (1 महीना पहले) |
|---|
| संयम | 12/09/2026 06:44 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403166 [cym1102 nginxWebUI तक 4.4.2 autoUpdate MainController.autoUpdate url अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|