0xJacky Nginx-UI up to 2.0.0.beta.8 Setting command injection

Summaryinfo

A vulnerability categorized as critical has been discovered in 0xJacky Nginx-UI up to 2.0.0.beta.8. This impacts an unknown function of the component Setting Handler. Executing a manipulation can lead to command injection. This vulnerability appears as CVE-2024-22197. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in 0xJacky Nginx-UI up to 2.0.0.beta.8 (Web Server). It has been declared as critical. This vulnerability affects an unknown functionality of the component Setting Handler. The manipulation with an unknown input leads to a command injection vulnerability. The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Nginx-ui is online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. The `Home > Preference` page exposes a small list of nginx settings such as `Nginx Access Log Path` and `Nginx Error Log Path`. However, the API also exposes `test_config_cmd`, `reload_cmd` and `restart_cmd`. While the UI doesn't allow users to modify any of these settings, it is possible to do so by sending a request to the API. This issue may lead to authenticated Remote Code Execution, Privilege Escalation, and Information Disclosure. This issue has been patched in version 2.0.0.beta.9.

The weakness was presented 01/11/2024 as GHSA-pxmr-q2x3-9x9m. The advisory is shared for download at github.com. This vulnerability was named CVE-2024-22197 since 01/08/2024. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading to version 2.0.0.beta.9 eliminates this vulnerability. Applying the patch 827e76c46e63c52114a62a899f61313039c754e3 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Web Server

Vendor

• 0xJacky

Name

• Nginx-UI

Version

• 2.0.0.beta.0
• 2.0.0.beta.1
• 2.0.0.beta.2
• 2.0.0.beta.3
• 2.0.0.beta.4
• 2.0.0.beta.5
• 2.0.0.beta.6
• 2.0.0.beta.7
• 2.0.0.beta.8

License

• open-source

Website

• Product: https://github.com/0xJacky/nginx-ui/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion