Executive brief
Nginx-UI, a web-based management interface for Nginx servers, contains a vulnerability that allows any logged-in user to execute arbitrary commands on the underlying system. By sending a specially crafted request to the application's settings API, an attacker can modify internal system commands used for testing configurations. This could lead to a full system takeover, unauthorized access to sensitive data, or disruption of web services.
Technical details
A command injection vulnerability exists in Nginx-UI due to improper neutralization of user-controlled input in the settings API. While the web UI restricts certain fields, the `SaveSettings` function in `api/system/settings.go` allows authenticated users (regardless of role) to modify sensitive fields like `test_config_cmd`, `reload_cmd`, and `restart_cmd` via direct API requests. These fields are later passed to `exec.Command("/bin/sh", "-c", ...)` in the `execShell` function without sanitization. An attacker can trigger the execution of their injected command by performing actions that invoke a configuration test, such as adding a new site. The issue is patched in version 1.9.10-0.20231219184941-827e76c46e63.
Affected products
- 0xJacky Nginx-UI < 1.9.10-0.20231219184941-827e76c46e63
Timeline
- 2024-01-11: advisory
- 2024-01-11: disclosed
- 2023-12-19: patched