Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

CVE-2024-22197

What is CVE-2024-22197?

A vulnerability exists in Nginx-ui, an online statistics tool for monitoring server indicators such as CPU and memory usage. The Home > Preference page reveals key Nginx settings including Nginx Access Log Path and Nginx Error Log Path. Notably, certain API endpoints expose sensitive commands (test_config_cmd, reload_cmd, restart_cmd) that allow for unauthorized manipulation via direct API requests, despite the UI's lack of modification capabilities for these parameters. This flaw can potentially lead to unauthorized remote code execution, privilege escalation, and disclosure of sensitive information. The issue has been addressed in version 2.0.0.beta.9.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References