Is CVE-2024-22196 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-22196 being exploited in the wild.

How severe is CVE-2024-22196?

High severity, with a CVSS score of 7, published 11 January 2024.

Which products and versions are affected?

0xJacky Nginx-UI < 1.9.10-0.20231219195202-ec93ab05a3ec; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20231219195202-ec93ab05a3ec, SEMVER:introduced=0,fixed=1.9.10-0.20231219195202-ec93ab05a3ec.

Is there a fix for CVE-2024-22196?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20231219195202-ec93ab05a3ec or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-22196 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2024-22196?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-22196: 0xJacky Nginx-UI SQL injection in OrderAndPaginate

Q: Which products and versions are affected?

0xJacky Nginx-UI < 1.9.10-0.20231219195202-ec93ab05a3ec; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20231219195202-ec93ab05a3ec, SEMVER:introduced=0,fixed=1.9.10-0.20231219195202-ec93ab05a3ec.

Q: Is there a fix for CVE-2024-22196?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20231219195202-ec93ab05a3ec or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-22196 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2024-22196?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-22196 · Severity: high · CVSS 7 · Published 2024-01-11

Nginx-UI, a web-based management interface for Nginx, is vulnerable to a security flaw that allows authenticated users to execute unauthorized database queries. By manipulating specific web requests used for sorting and paging data, an attacker could gain access to sensitive information stored in the system's database. This could lead to the exposure of configuration details or other private data managed by the application.

Technologies: 0xJacky Nginx-UI, github.com/0xJacky/Nginx-UI (Go). Vendors: 0xJacky, Go.

Quick answers

Is CVE-2024-22196 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-22196 being exploited in the wild.
How severe is CVE-2024-22196?: High severity, with a CVSS score of 7, published 11 January 2024.
Which products and versions are affected?: 0xJacky Nginx-UI < 1.9.10-0.20231219195202-ec93ab05a3ec; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20231219195202-ec93ab05a3ec, SEMVER:introduced=0,fixed=1.9.10-0.20231219195202-ec93ab05a3ec.
Is there a fix for CVE-2024-22196?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20231219195202-ec93ab05a3ec or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-22196 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-22196?: Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20231219195202-ec93ab05a3ec or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20231219195202-ec93ab05a3ec
```

Technical details

A SQL injection vulnerability exists in Nginx-UI's `OrderAndPaginate` and `SortOrder` functions within `model/model.go`. The application uses `fmt.Sprintf` to construct SQL ORDER BY clauses using the `sort_by` and `order` query parameters without sufficient sanitization or parameterization. An authenticated attacker can exploit this by sending crafted GET requests to endpoints using these functions (such as `/api/dns_credentials`), using CASE statements or other SQL syntax to perform boolean-based or error-based inference of database contents. The vulnerability was addressed in version 1.9.10-0.20231219195202-ec93ab05a3ec.

Affected products

0xJacky Nginx-UI < 1.9.10-0.20231219195202-ec93ab05a3ec

Identifiers

CVE-2024-22196
GHSA-h374-mm57-879c
GO-2024-2463

Timeline

2024-01-11: disclosed
2024-01-11: advisory
2023-12-19: patched: Patch committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.