Improper privilege management in nginx-ui - #VU157121

Vulnerability details

The vulnerability allows a remote user to escalate privileges from a write-scoped service token to a persistent interactive administrator and gain complete control over the Nginx UI instance.

The vulnerability exists due to improper privilege management in the POST /api/restore endpoint when authorizing restore requests made with service tokens: the interactive-user denylist omits the endpoint, and write scope satisfies its secure-session check. A remote user can upload a crafted portable backup containing an enabled administrator account with a known password hash in database.db to replace the live user database and sign in as that administrator after the service restarts.

Affected software

Remediation

External References

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-2whh-h3rf-hw59

Related Security Bulletins

• Multiple vulnerabilities in nginx-ui