CVE-2024-22198

Deeper analysis

Nginx-UI is a web-based interface for managing Nginx configurations that is affected by an improper access control flaw tracked as CVE-2024-22198. The Home > Preference page surfaces sensitive settings including Run Mode, Jwt Secret, Node Secret, and Terminal Start Command; although the user interface prevents modification of the Terminal Start Command value, the underlying API endpoint accepts changes to it, enabling an attacker to supply an arbitrary command string that is later executed by the terminal subsystem.

An authenticated user with low-privileged access can exploit the issue over the network by directly invoking the settings API, achieving remote code execution, privilege escalation, and disclosure of secrets. The attack requires no user interaction and succeeds when the attacker can reach the management interface, resulting in a CVSS 3.1 score of 7.1.

The vulnerability was addressed in release 2.0.0.beta.9, which restricts modification of the Terminal Start Command setting. The supplied references point to the affected code paths in settings.go, pty.go, pipeline.go, middleware.go, and server.go that were updated in the patch.

EPSS for the CVE rose from a low baseline to a peak of 0.2031, indicating that exploitation interest increased after public disclosure.