CVE-2024-23828: 0xJacky Nginx-UI authenticated RCE via CRLF injection in app.ini

Executive brief

Nginx-UI is a web-based management interface for the Nginx web server. A vulnerability allows an authenticated user to inject malicious commands into the application's configuration file. If exploited, an attacker can gain full control over the host system, potentially leading to data theft, service disruption, or further network compromise.

Technical details

Nginx-UI is vulnerable to a CRLF injection vulnerability in its configuration management component. An authenticated attacker with low privileges can inject carriage return and line feed (CRLF) characters into the application's configuration file (app.ini). This allows the attacker to overwrite sensitive configuration values, specifically 'test_config_cmd' and 'start_cmd'. By modifying these commands, the attacker can achieve remote code execution (RCE) on the underlying host. This vulnerability is a bypass for previous fixes (GHSA-pxmr-q2x3-9x9m and GHSA-8r25-68wm-jw35) and is addressed in version 1.9.10-0.20240126104956-d70e37c8575e.

Affected products

• 0xJacky Nginx-UI < 1.9.10-0.20240126104956-d70e37c8575e

Timeline

• 2024-01-28: disclosed
• 2024-01-29: advisory
• 2024-01-29: patched

References

• https://api.github.com/users/Elleuch-x1
• https://github.com/Elleuch-x1
• https://api.github.com/users/Elleuch-x1/gists%7B/gist_id%7D
• https://api.github.com/users/Elleuch-x1/repos
• https://avatars.githubusercontent.com/u/26652608?v=4
• https://api.github.com/users/Elleuch-x1/events%7B/privacy%7D