Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)

CVE-2024-22198

What is CVE-2024-22198?

Nginx-UI, a web interface designed for managing Nginx configurations, has a vulnerability that allows for arbitrary command execution. This vulnerability arises from the exposure of sensitive configuration settings on the 'Home > Preference' page. Although users cannot directly modify the 'Terminal Start Command' through the UI, an attacker can send crafted requests to the API to exploit this flaw. The consequences include the possibility of authenticated remote code execution, which could enable privilege escalation and lead to information disclosure. A patch is available in version 2.0.0.beta.9 to rectify this issue.

References