CVE-2024-22197
📋 TL;DR
This vulnerability in nginx-ui allows authenticated users to modify critical nginx configuration commands via API endpoints that should be restricted, potentially leading to remote code execution, privilege escalation, and information disclosure. It affects all nginx-ui installations prior to version 2.0.0.beta.9 where the web interface is accessible.
💻 Affected Systems
- nginx-ui
📦 What is this software?
Nginx Ui by Nginxui
Nginx Ui by Nginxui
Nginx Ui by Nginxui
Nginx Ui by Nginxui
Nginx Ui by Nginxui
Nginx Ui by Nginxui
Nginx Ui by Nginxui
Nginx Ui by Nginxui
Nginx Ui by Nginxui
Nginx Ui by Nginxui
Nginx Ui by Nginxui
Nginx Ui by Nginxui
Nginx Ui by Nginxui
Nginx Ui by Nginxui
⚠️ Risk & Real-World Impact
Worst Case
Authenticated attacker gains root-level remote code execution on the nginx server, leading to complete system compromise, data theft, and lateral movement.
Likely Case
Authenticated user modifies nginx commands to execute arbitrary code with nginx process privileges, potentially escalating to root access.
If Mitigated
Attack is prevented by proper authentication controls and network segmentation, limiting impact to configuration changes only.
🎯 Exploit Status
Exploitation requires authenticated access to the nginx-ui web interface and knowledge of API endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.0.beta.9
Vendor Advisory: https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pxmr-q2x3-9x9m
Restart Required: Yes
Instructions:
1. Stop nginx-ui service. 2. Backup current installation. 3. Update to version 2.0.0.beta.9 or later. 4. Restart nginx-ui service. 5. Verify functionality.
🔧 Temporary Workarounds
Restrict API Access
allBlock access to vulnerable API endpoints using web server configuration or firewall rules.
# Example nginx config to block specific endpoints
location ~ ^/api/(test_config_cmd|reload_cmd|restart_cmd) {
deny all;
return 403;
}
Network Segmentation
linuxRestrict access to nginx-ui interface to trusted networks only.
# Example iptables rule
sudo iptables -A INPUT -p tcp --dport [nginx-ui-port] -s [trusted-network] -j ACCEPT
sudo iptables -A INPUT -p tcp --dport [nginx-ui-port] -j DROP
🧯 If You Can't Patch
- Disable nginx-ui web interface entirely and use alternative monitoring solutions.
- Implement strict network access controls to limit nginx-ui access to essential personnel only.
🔍 How to Verify
Check if Vulnerable:
Check nginx-ui version via web interface or by examining installed package version. Versions before 2.0.0.beta.9 are vulnerable.Check Version:
curl -s http://localhost:[port]/api/settings | grep versionVerify Fix Applied:
Verify version is 2.0.0.beta.9 or later and test that API endpoints no longer accept unauthorized modifications.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /api/settings endpoint
- Modifications to nginx configuration commands via API
- Failed authentication attempts followed by API access
Network Indicators:
- HTTP requests to /api/settings with command modification parameters
- Unusual outbound connections from nginx server following API access
SIEM Query:
source="nginx-ui" AND (uri_path="/api/settings" AND http_method="POST")🔗 References
- https://github.com/0xJacky/nginx-ui/commit/827e76c46e63c52114a62a899f61313039c754e3
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pxmr-q2x3-9x9m
- https://github.com/0xJacky/nginx-ui/commit/827e76c46e63c52114a62a899f61313039c754e3
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pxmr-q2x3-9x9m
