CVE-2024-22198

high-risk

Published 2024-01-11

Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings. The `Home > Preference` page exposes a list of system settings such as `Run Mode`, `Jwt Secret`, `Node Secret` and `Terminal Start Command`. While the UI doesn't allow users to modify the `Terminal Start Command` setting, it is possible to do so by sending a request to the API. This issue may lead to authenticated remote code execution, privilege escalation, and information disclosure. This vulnerability has been patched in version 2.0.0.beta.9.

Do I need to act?

16.0% chance of exploitation in next 30 days

EPSS score — higher than 84% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.1/10 High

NETWORK / HIGH complexity

Affected Products (14)

Nginx Ui

Affected Vendors

Nginxui

References (14)

Product https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885...

Patch https://github.com/0xJacky/nginx-ui/commit/827e76c46e63c52114a62a899f61313039c75...

Exploit https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35

Product https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885...

Patch https://github.com/0xJacky/nginx-ui/commit/827e76c46e63c52114a62a899f61313039c75...

Exploit https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35

/ 100

high-risk

Severity 21/34 · High

Exploitability 13/34 · Low

Exposure 18/34 · Moderate