Is CVE-2024-22198 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-22198 being exploited in the wild.

How severe is CVE-2024-22198?

High severity, with a CVSS score of 7.1, published 11 January 2024.

Which products and versions are affected?

0xJacky Nginx-UI < 1.9.10-0.20231219184941-827e76c46e63; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20231219184941-827e76c46e63, SEMVER:introduced=0,fixed=1.9.10-0.20231219184941-827e76c46e63.

Is there a fix for CVE-2024-22198?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20231219184941-827e76c46e63 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-22198 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2024-22198?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-22198: 0xJacky Nginx-UI command injection via start_cmd setting

Q: Which products and versions are affected?

0xJacky Nginx-UI < 1.9.10-0.20231219184941-827e76c46e63; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20231219184941-827e76c46e63, SEMVER:introduced=0,fixed=1.9.10-0.20231219184941-827e76c46e63.

Q: Is there a fix for CVE-2024-22198?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20231219184941-827e76c46e63 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-22198 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2024-22198?

Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-22198 · Severity: high · CVSS 7.1 · Published 2024-01-11

Nginx-UI, a web-based management interface for Nginx configurations, contains a vulnerability that allows any logged-in user to execute arbitrary system commands. By modifying a hidden configuration setting via the API, an attacker can gain full control over the underlying server with root privileges. This could lead to a complete system takeover, unauthorized data access, or service disruption.

Technologies: 0xJacky Nginx-UI, github.com/0xJacky/Nginx-UI (Go). Vendors: 0xJacky, Go.

Quick answers

Is CVE-2024-22198 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-22198 being exploited in the wild.
How severe is CVE-2024-22198?: High severity, with a CVSS score of 7.1, published 11 January 2024.
Which products and versions are affected?: 0xJacky Nginx-UI < 1.9.10-0.20231219184941-827e76c46e63; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20231219184941-827e76c46e63, SEMVER:introduced=0,fixed=1.9.10-0.20231219184941-827e76c46e63.
Is there a fix for CVE-2024-22198?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20231219184941-827e76c46e63 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-22198 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-22198?: Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20231219184941-827e76c46e63 or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20231219184941-827e76c46e63
```

Technical details

Nginx-UI is vulnerable to command injection (CWE-77) due to improper authorization and input validation in its settings API. While the web UI restricts modification of the 'Terminal Start Command' (start_cmd), the backend 'SaveSettings' function in 'api/system/settings.go' allows any authenticated user (regardless of role) to update this value via a POST request to '/api/settings'. This value is subsequently used as an argument for 'exec.Command' in the 'NewPipeLine' function when a user opens a terminal session. An attacker with low-privileged credentials can overwrite this setting with a shell command (e.g., 'bash') and trigger its execution by opening a terminal, resulting in remote code execution as the root user. The issue is fixed in version 1.9.10-0.20231219184941-827e76c46e63.

Affected products

0xJacky Nginx-UI < 1.9.10-0.20231219184941-827e76c46e63

Identifiers

CVE-2024-22198
GHSA-8r25-68wm-jw35
GO-2024-2462

Timeline

2024-01-11: advisory: GitHub Advisory GHSA-8r25-68wm-jw35 published
2024-01-11: disclosed: CVE-2024-22198 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.