Is CVE-2024-22197 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-22197 being exploited in the wild.

How severe is CVE-2024-22197?

High severity, with a CVSS score of 7.7, published 11 January 2024.

Which products and versions are affected?

0xJacky Nginx-UI < 1.9.10-0.20231219184941-827e76c46e63; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20231219184941-827e76c46e63, SEMVER:introduced=0,fixed=1.9.10-0.20231219184941-827e76c46e63.

Is there a fix for CVE-2024-22197?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20231219184941-827e76c46e63 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-22197 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2024-22197?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-22197: 0xJacky Nginx-UI command injection in Nginx settings API

Q: Which products and versions are affected?

0xJacky Nginx-UI < 1.9.10-0.20231219184941-827e76c46e63; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20231219184941-827e76c46e63, SEMVER:introduced=0,fixed=1.9.10-0.20231219184941-827e76c46e63.

Q: Is there a fix for CVE-2024-22197?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20231219184941-827e76c46e63 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-22197 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2024-22197?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-22197 · Severity: high · CVSS 7.7 · Published 2024-01-11

Nginx-UI, a web-based management interface for Nginx servers, contains a vulnerability that allows any logged-in user to execute arbitrary commands on the underlying system. By sending a specially crafted request to the application's settings API, an attacker can modify internal system commands used for testing configurations. This could lead to a full system takeover, unauthorized access to sensitive data, or disruption of web services.

Technologies: 0xJacky Nginx-UI, github.com/0xJacky/Nginx-UI (Go). Vendors: 0xJacky, Go.

Quick answers

Is CVE-2024-22197 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-22197 being exploited in the wild.
How severe is CVE-2024-22197?: High severity, with a CVSS score of 7.7, published 11 January 2024.
Which products and versions are affected?: 0xJacky Nginx-UI < 1.9.10-0.20231219184941-827e76c46e63; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20231219184941-827e76c46e63, SEMVER:introduced=0,fixed=1.9.10-0.20231219184941-827e76c46e63.
Is there a fix for CVE-2024-22197?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20231219184941-827e76c46e63 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-22197 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-22197?: Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20231219184941-827e76c46e63 or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20231219184941-827e76c46e63
```

Technical details

A command injection vulnerability exists in Nginx-UI due to improper neutralization of user-controlled input in the settings API. While the web UI restricts certain fields, the `SaveSettings` function in `api/system/settings.go` allows authenticated users (regardless of role) to modify sensitive fields like `test_config_cmd`, `reload_cmd`, and `restart_cmd` via direct API requests. These fields are later passed to `exec.Command("/bin/sh", "-c", ...)` in the `execShell` function without sanitization. An attacker can trigger the execution of their injected command by performing actions that invoke a configuration test, such as adding a new site. The issue is patched in version 1.9.10-0.20231219184941-827e76c46e63.

Affected products

0xJacky Nginx-UI < 1.9.10-0.20231219184941-827e76c46e63

Identifiers

CVE-2024-22197
GHSA-pxmr-q2x3-9x9m
GO-2024-2464

Timeline

2024-01-11: advisory
2024-01-11: disclosed
2023-12-19: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.