Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

CVE-2024-22197

What is CVE-2024-22197?

A vulnerability exists in Nginx-ui, an online statistics tool for monitoring server indicators such as CPU and memory usage. The Home > Preference page reveals key Nginx settings including Nginx Access Log Path and Nginx Error Log Path. Notably, certain API endpoints expose sensitive commands (test_config_cmd, reload_cmd, restart_cmd) that allow for unauthorized manipulation via direct API requests, despite the UI's lack of modification capabilities for these parameters. This flaw can potentially lead to unauthorized remote code execution, privilege escalation, and disclosure of sensitive information. The issue has been addressed in version 2.0.0.beta.9.

References