Input validation error in nginx-ui - #VU138336

Vulnerability details

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper input validation in the MCP nginx_config_add tool when processing caller-supplied nginx configuration content. A remote user can submit crafted nginx directives to execute arbitrary code.

Code execution is achievable on deployments where the njs or perl module is available, including the official Docker image. On stock nginx without those modules, the issue can still cause a denial of service by triggering a failed reload. The vulnerable write path is limited to the nginx configuration directory, but the main nginx.conf file within that directory can be overwritten.

Affected software

Remediation

External References

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr
• https://github.com/0xJacky/Nginx-UI/commit/3e411d38

Related Security Bulletins

• Multiple vulnerabilities in nginx-ui