Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)

CVE-2024-22198

What is CVE-2024-22198?

Nginx-UI, a web interface designed for managing Nginx configurations, has a vulnerability that allows for arbitrary command execution. This vulnerability arises from the exposure of sensitive configuration settings on the 'Home > Preference' page. Although users cannot directly modify the 'Terminal Start Command' through the UI, an attacker can send crafted requests to the API to exploit this flaw. The consequences include the possibility of authenticated remote code execution, which could enable privilege escalation and lead to information disclosure. A patch is available in version 2.0.0.beta.9 to rectify this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References