CVE-2024-49368

HIGH

Unchecked logrotate settings lead to arbitrary command execution

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-49368 has a selected CVSS score of 8.9 (high); EIP currently links 1 repository PoC and 1 lab environment.

Description

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 31, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

nginx-ui

Browse 0xJacky / nginx-ui
CVE List< 2.0.0-beta.36affected

nginx_ui

Browse nginxui / nginx_ui

Default status: unknown

CVE ListBefore 2.0.0-beta.36affected

Proofs of concept

1

Repository PoCs

GitHubAashay221999/CVE-2024-49368Repository PoCby Aashay2219990Not analyzed15 files

16.8 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

docker-compose.yml

Aashay221999/CVE-2024-49368Created Vuln labCVE-2024-49368Compose · mixed

1 Compose manifest · 1 Dockerfile · 3 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for demonstrating CVE-2024-49368, a command injection vulnerability in Nginx UI. It includes a vulnerable Nginx UI instance (v2.0.0-beta.35), a patched instance (v2.0.0-beta.36), and a custom Node.js application with a login page. Exploit scripts are provided to trigger a reverse shell on the vulnerable instance.

docker-compose.yml:1-39README.md:1-51exploit_bash.py:1-117

Lab assessment

Vulnerability lab

The repository name, README, and exploit scripts explicitly reference CVE-2024-49368. The Docker Compose file sets up a vulnerable Nginx UI version alongside a patched version, and the README provides steps to run the exploit and verify command injection, which is consistent with a vulnerability reproduction lab.

README.md:1docker-compose.yml:16docker-compose.yml:30exploit_bash.py:1-117
Lab shapeCompose · mixed
Services3
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

nginx-ui

vulnerable target

Runs Nginx UI v2.0.0-beta.35, which is the vulnerable version targeted by the exploit. It exposes ports 8080, 8443, and 8000 on the host and mounts host directories for configuration and web content.

docker-compose.yml:3-17

nginx-ui-patched

patched target

Runs Nginx UI v2.0.0-beta.36, a patched version, for comparison. It exposes ports 7080 and 7443 on the host and mounts separate host directories.

docker-compose.yml:25-38

app

custom web application

A Node.js application built from the local Dockerfile. It runs a server on port 10000 with a /login endpoint and a UI server on port 10001 serving a login page. The login page is styled as a 'National Database of Nuclear Codes' but uses hardcoded credentials (admin/password).

docker-compose.yml:18-23Dockerfile:1-16server/server.js:1-22ui/ui-server.js:1-15ui/index.html:1-114

exploit_bash.py

exploit script for vulnerable instance

A Python script that logs into the vulnerable Nginx UI at http://127.0.0.1:8080, retrieves JWT and node secrets, and sends a crafted settings payload to trigger a reverse shell to 172.26.25.2:9001 via the logrotate command.

exploit_bash.py:1-117

exploit_bash_patched.py

exploit script for patched instance

A Python script similar to exploit_bash.py but targeting the patched Nginx UI at http://127.0.0.1:7080 with a reverse shell to 172.26.25.2:9002.

exploit_bash_patched.py:1-117
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-49368

Supported by supplied evidence

The lab explicitly targets CVE-2024-49368. The vulnerable Nginx UI version (v2.0.0-beta.35) is used, and the exploit script sends a payload to the /api/settings endpoint with a malicious logrotate command, which aligns with the known command injection vulnerability in Nginx UI's settings endpoint.

docker-compose.yml:16exploit_bash.py:48-56README.md:1
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.README.md:6-7
  • Host directories /mnt/user/appdata/nginx, /mnt/user/appdata/nginx-ui, /home/aashay/CVE_2024_49368/www, /mnt/user/appdata/nginx-patched, /mnt/user/appdata/nginx-patched-ui, and /home/aashay/CVE_2024_49368/patched/www must exist or be created for volume mounts.docker-compose.yml:10-12docker-compose.yml:33-35
  • Nginx configuration file must include 'include /etc/nginx/conf.d/*.conf;' and 'include /etc/nginx/sites-enabled/*;' in the http block.README.md:11-17
  • A user with credentials (e.g., admin/admin) must be created in the Nginx UI web interface before running the exploit.README.md:28-30
  • The exploit script requires Python with the requests library and network access to the target Nginx UI instance.exploit_bash.py:1

Evidence-described exercise path

  1. Start the Docker Compose environment with 'docker compose up -d'.README.md:22-24
  2. Verify the Nginx UI container is running with 'sudo docker ps'.README.md:25-27
  3. Access the Nginx UI at http://127.0.0.1:8080 and create an admin user (e.g., admin/admin).README.md:28-30
  4. Run the exploit script (exploit_bash.py) to trigger the command injection.README.md:31
  5. Verify command injection by exec'ing into the container and checking /tmp for created files.README.md:32-41
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The exploit scripts target the lab's own vulnerable Nginx UI container with a reverse shell to a private IP address (172.26.25.2), which is consistent with a documented vulnerability demonstration. There is no evidence of host compromise, external targeting, credential theft, or unexpected harmful behavior. The host volume mounts and docker exec instructions are part of the lab setup and verification steps.

exploit_bash.py:55README.md:32-41
Review boundaries

What the analysis did not establish

  • The packet does not include the actual Nginx UI binary or source code; only the Docker image tag is referenced.
  • The exploit scripts contain hardcoded IP addresses (172.26.25.2) that are assumed to be operator-controlled listeners, but their ownership cannot be verified from the packet.
  • The custom 'app' service is not directly related to the CVE and its purpose is unclear, but it does not exhibit harmful behavior.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

2