CVE-2024-23827: 0xJacky Nginx-UI arbitrary file write in Import Certificate feature

Executive brief

Nginx-UI, a web-based management interface for Nginx, contains a vulnerability in its certificate import feature. An attacker can use this flaw to write or overwrite any file on the server's filesystem. This could allow an attacker to take full control of the server, potentially leading to data theft or service disruption.

Technical details

A path traversal and arbitrary file write vulnerability exists in Nginx-UI's 'Import Certificate' feature. The `AddCert` function in `api/certificate/certificate.go` accepts user-provided file paths for SSL certificates and keys without validation. These paths are passed directly to `os.MkdirAll` and `os.WriteFile`, allowing an unauthenticated or authenticated attacker (depending on deployment configuration) to write arbitrary content to any location on the host filesystem. By overwriting sensitive configuration files like `app.ini` and modifying startup commands, an attacker can achieve remote code execution (RCE) upon application restart. The vulnerability is addressed in version 1.9.10-0.20240128060047-8581bdd3c6f4.

Affected products

• 0xJacky Nginx-UI < 1.9.10-0.20240128060047-8581bdd3c6f4

Timeline

• 2024-01-28: disclosed
• 2024-01-29: advisory
• 2024-01-29: patched

References

• https://api.github.com/users/Elleuch-x1
• https://github.com/Elleuch-x1
• https://api.github.com/users/Elleuch-x1/gists%7B/gist_id%7D
• https://api.github.com/users/Elleuch-x1/repos
• https://avatars.githubusercontent.com/u/26652608?v=4
• https://api.github.com/users/Elleuch-x1/events%7B/privacy%7D