Skip to main content

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVE-2024-22197

High
8.8/10

Summary

Nginx-ui is online statistics for Server Indicators that Monitor CPU usage, memory usage, load average, and disk usage in real time. The "Home > Preference" page exposes a small list of nginx settings such as "Nginx Access Log Path" and "Nginx Error Log Path". However, the API also exposes "test_config_cmd", "reload_cmd" and "restart_cmd". While the UI doesn't allow users to modify any of these settings, it is possible to do so by sending a request to the API. This issue may lead to authenticated Remote Code Execution, Privilege Escalation, and Information Disclosure. This issue affects github.com/0xJacky/Nginx-UI versions v2.0.0-beta.5-patch through v2.0.0-beta.8-patch.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • HIGH

CWE-77 - Command Injection

A command injection attack involves injecting an operating system command through the data input, which gets executed on the host operating system with the privileges of the victimized application. The impact of a command injection attack may range from loss of data confidentiality and integrity to unauthorized remote access to the hosting system. The attack may cause serious data breaches and system takeover.

References

Advisory Timeline

  • Published