SB20260814126 - Multiple vulnerabilities in nginx-ui

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to authenticate a victim\'s browser as the attacker\'s account and disclose sensitive information.

The vulnerability exists due to improper authentication in the Casdoor SSO callback flow when handling OAuth callback requests. A remote attacker can submit a crafted authorization code and state value to authenticate the victim as the attacker\'s account and disclose sensitive information.

User interaction is required to visit an attacker-controlled page that submits the callback request.

2) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to take over accounts persistently.

The vulnerability exists due to improper authentication in the TOTP and passkey enrolment endpoints when handling requests with only a valid JWT. A remote user can bind an attacker-controlled TOTP secret or register passkeys for the current user to take over accounts persistently.

Exploitation requires a stolen valid JWT for the victim account and affects users who have not yet enabled TOTP, while passkey registration can be performed multiple times.

Remediation

Install update from vendor's website.

References

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-44xr-mrhh-qm78
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-gfrc-g87h-7h5w