Executive brief
nginxWebUI is a web-based configuration tool for managing Nginx servers. A code injection vulnerability in the autoUpdate function allows attackers to execute arbitrary code by manipulating the URL parameter, potentially leading to complete server compromise and unauthorized control of the web server.
Technical details
The vulnerability is a code injection flaw in the MainController.autoUpdate() method located at /adminPage/main/autoUpdate. The vulnerable function accepts an arbitrary URL parameter without proper validation or sanitization, allowing an attacker to supply a malicious URL pointing to a crafted JAR file. When the application downloads and executes this JAR, arbitrary code runs with the privileges of the nginxWebUI process. The attack requires network access to the vulnerable endpoint; authentication status is not clearly specified but the endpoint path suggests administrative access may be required. A proof-of-concept demonstrates execution of arbitrary system commands. A fix is pending acceptance in the project repository.
Affected products
- cym1102 nginxWebUI up to 4.4.2
Timeline
- 2026-08-02: disclosed
- 2026-09-13: published