CVE-2024-22198

HIGH

Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-22198 has a selected CVSS score of 7.1 (high); EIP currently links 1 repository PoC.

Description

Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings. The `Home > Preference` page exposes a list of system settings such as `Run Mode`, `Jwt Secret`, `Node Secret` and `Terminal Start Command`. While the UI doesn't allow users to modify the `Terminal Start Command` setting, it is possible to do so by sending a request to the API. This issue may lead to authenticated remote code execution, privilege escalation, and information disclosure. This vulnerability has been patched in version 2.0.0.beta.9.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 1, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

nginx-ui

Browse 0xJacky / nginx-ui
CVE List< 2.0.0.beta.9affected

nginx_ui

Browse nginxui / nginx_ui

Default status: unknown

CVE ListBefore 2.0.0.beta.8affected
2.0.0unaffected

github.com/0xJacky/Nginx-UI

Browse Go / github.com/0xJacky/Nginx-UI
GitHub AdvisoryBefore 1.9.10-0.20231219184941-827e76c46e63 · Fixed in 1.9.10-0.20231219184941-827e76c46e63affected

Proofs of concept

1

Repository PoCs

GitHubxiw1ll/CVE-2024-22198_CheckerRepository PoCby xiw1ll0Not analyzed2 files

2.4 KiB

GitHub
PoC details

References

10