CVE-2024-22198
Published Jan 11, 2024
Last updated 10 months ago
Overview
- Description
- Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings. The `Home > Preference` page exposes a list of system settings such as `Run Mode`, `Jwt Secret`, `Node Secret` and `Terminal Start Command`. While the UI doesn't allow users to modify the `Terminal Start Command` setting, it is possible to do so by sending a request to the API. This issue may lead to authenticated remote code execution, privilege escalation, and information disclosure. This vulnerability has been patched in version 2.0.0.beta.9.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
Weaknesses
- security-advisories@github.com
- CWE-77
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B4426F94-540E-497C-AE75-04126AF12112",
"versionEndExcluding": "2.0.0"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3C287A7F-66B4-406A-B87B-B954A1CA6D44"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "25DD91AC-465B-4A43-A79F-4DE47243741C"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "115588C7-D947-4576-9E6C-B5AF1FCE9A29"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BBB20EA3-F3CF-42AF-A217-D5DF7A7ADD70"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4_patch:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "81A6C732-FBF2-44A8-B810-456E54B59A09"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C5664E5-150E-4B4B-BA0C-420738820FF1"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5_patch:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7E764AA1-3060-441F-8F14-ADD165316741"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "04A3E84F-91AA-420A-B908-3393E037AC44"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "828EAE87-24E5-4F31-B301-BA2F96BDEA42"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "45710D36-954A-4450-B622-CB0F368DF544"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B57EEFB-5518-4BD5-998A-34B6690A6F4C"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8EDF4CEE-F24D-441B-92A8-7F5A2B41487E"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8_patch:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F0275FDF-BAE8-4909-8991-6FCE34B8905E"
}
],
"operator": "OR"
}
]
}
]