Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
31 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. Vulnerability Details | Field | Value | |-------|-------| | CWE | CWE-306: Missing Authentication for Critical Function + CWE-311: Missing Encryption of Sensitive Data | | Affected File | api/backup/router.go | | Affected Function | CreateBackup (lines 8-11 in router, implementation in api/backup/backup.go:13-38) | | Secondary File | internal/backup/backup.go | | CVSS 3.1 | 9.8 (Critical) | | CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Root Cause The vulnerability exists due to two critical security flaws: 1. Missing Authentication on /api/backup Endpoint In api/backup/router.go:9, the backup…
Recommended action: Upgrade to 2.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/0xJacky/Nginx-UI < 1.9.10-0.20240126104956-d70e37c8575e
Fixed in
1.9.10-0.20240126104956-d70e37c8575e· Vendor fix available
Issue
Fix bypass to the following bugs - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pxmr-q2x3-9x9m - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35 Allowing to inject directly in the app.ini via CRLF to change the value of testconfigcmd and startcmd resulting in an Authenticated RCE Impact Authenticated Remote execution on the host
Recommended action: Upgrade to 1.9.10-0.20240126104956-d70e37c8575e (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/0xJacky/Nginx-UI < 1.9.10-0.20240128060047-8581bdd3c6f4
Fixed in
1.9.10-0.20240128060047-8581bdd3c6f4· Vendor fix available
Issue
The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. https://github.com/0xJacky/nginx-ui/blob/f20d97a9fdc2a83809498b35b6abc0239ec7fdda/api/certificate/certificate.go#L72 https://github.com/0xJacky/nginx-ui/blob/f20d97a9fdc2a83809498b35b6abc0239ec7fdda/internal/cert/writefile.go#L15 PoC It's possible to leverage it into an RCE in a senario by overwriting the config file app.ini - But it will require the app. Then we overwrite the StartCmd with bash For the new config to be applied the app needs to be restarted Impact Arbitrary write/overwrite into the host file system with a risk of remote code execution if the app restarts.
Recommended action: Upgrade to 1.9.10-0.20240128060047-8581bdd3c6f4 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/0xJacky/Nginx-UI < 1.9.10-0.20231219184941-827e76c46e63
Fixed in
1.9.10-0.20231219184941-827e76c46e63· Vendor fix available
Issue
Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings. Details The Home Preference page exposes a list of system settings such as Run Mode, Jwt Secret, Node Secret and Terminal Start Command. The latter is used to specify the command to be executed when a user opens a terminal from the web interface. While the UI doesn't allow users to modify the Terminal Start Command setting, it is possible to do so by sending a request to the API. The SaveSettings function is used to save the settings. It is protected by the authRequired middleware, which requires a valid JWT token or a X-Node-Secret which must equal the Node Secret configuration value. However, given the lack of authorization roles, any authenticated user can modify the settings. The SaveSettings function is defined as follows: The Terminal Start Command setting is stored as settings.ServerSettings.StartCmd. By spawning a terminal…
Recommended action: Upgrade to 1.9.10-0.20231219184941-827e76c46e63 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/0xJacky/Nginx-UI < 1.9.10-0.20231219184941-827e76c46e63
Fixed in
1.9.10-0.20231219184941-827e76c46e63· Vendor fix available
Issue
The Home Preference page exposes a small list of nginx settings such as Nginx Access Log Path and Nginx Error Log Path. However, the API also exposes testconfigcmd, reloadcmd and restartcmd. While the UI doesn't allow users to modify any of these settings, it is possible to do so by sending a request to the API. The SaveSettings function is used to save the settings. It is protected by the authRequired middleware, which requires a valid JWT token or a X-Node-Secret which must equal the Node Secret configuration value. However, given the lack of authorization roles, any authenticated user can modify the settings. The SaveSettings function is defined as follows: The testconfigcmd setting is stored as settings.NginxSettings.TestConfigCmd. When the application wants to test the nginx configuration, it uses the TestConf function: The execShell function is defined as follows: Where the cmd argument is user-controlled and is passed to /bin/sh -c. This issue was found using CodeQL…
Recommended action: Upgrade to 1.9.10-0.20231219184941-827e76c46e63 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/0xJacky/Nginx-UI < 1.9.10-0.20231219195202-ec93ab05a3ec
Fixed in
1.9.10-0.20231219195202-ec93ab05a3ec· Vendor fix available
Issue
The OrderAndPaginate function is used to order and paginate data. It is defined as follows: By using DefaultQuery, the "desc" and "id" values are used as default values if the query parameters are not set. Thus, the order and sortby query parameter are user-controlled and are being appended to the order variable without any sanitization. The same happens with SortOrder, but it doesn't seem to be used anywhere. This issue was found using CodeQL for Go: Database query built from user-controlled sources. Proof of Concept Based on this setup using uozi/nginx-ui:v2.0.0-beta.7. In order to exploit this issue, we need to find a place where the OrderAndPaginate function is used. We can find it in the GET /api/dnscredentials endpoint. The PagingList function is defined as follows: And the PagingListData function is defined as follows: Using the following request, an attacker can retrieve arbitrary values by checking the order used by the query. That is, the result of the comparison…
Recommended action: Upgrade to 1.9.10-0.20231219195202-ec93ab05a3ec (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.