GHSA-5v7c-xpfp-p65m: Path Traversal

Reporter: Jagadesh Achanta

Target: 0xJacky/nginx-ui

Affected version / commit tested: - App version: 2.3.10 - Commit: 4948fba8744e82c3d7003f68ee164e9f49421066 - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: cred:github-jagstack-gh-cli

AI assistance disclosure

This report was prepared by Jagadesh Achanta with assistance from OpenAI/Codex for public source review, local evidence collection, and report drafting.

Summary

Nginx UI has a short-lived OTP/passkey "secure session" step-up boundary for users with 2FA enabled. RequireSecureSession() rejects an OTP-enabled user's request unless the request includes a valid X-Secure-Session-ID issued after a fresh OTP/passkey verification.

The project already applies this step-up middleware to sensitive operations such as:

- Nginx config create/edit/rename/delete; - site save/delete/enable/disable/rename/duplicate; - stream save/delete/enable/disable/rename/duplicate; - settings save and protected secret reads; - backup restore.

However, several similarly sensitive authenticated mutation routes remain outside RequireSecureSession(). An attacker who obtains an authenticated JWT/session for a 2FA-enabled user, but does not have the victim's fresh OTP/passkey secure-session token, can still perform those operations.

The affected route groups include:

- automatic backup create/modify/delete/restore/test-S3 operations; - DNS credential create/edit/delete operations; - certificate and ACME user create/modify/delete/register operations; - DNS domain, record, and DDNS create/update/delete operations; - Nginx reload/restart, stub-status toggle, performance-setting update, and module-cache refresh operations; - site/stream advanced-mode toggles and batch updates; - auto-certificate binding/unbinding for sites; - site navigation order and health-check updates.

This report is distinct from my earlier Nginx UI report about auto-backup path traversal. This report is about missing 2FA step-up authorization on sensitive authenticated mutation routes.

Why this is a security boundary

internal/middleware/securesession.go only requires a secure-session token for users with OTP enabled. For OTP users, it reads X-Secure-Session-ID from the header or query string and aborts with 401 Unauthorized if the secure session is missing or invalid:

go if !cUser.EnabledOTP() { c.Next() return } ssid := c.GetHeader("X-Secure-Session-ID") if ssid == "" { ssid = c.Query("X-Secure-Session-ID") } if ssid == "" { c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{ "message": "Secure Session ID is empty", }) return }

if user.VerifySecureSessionID(ssid, cUser.ID) { c.Next() return }

internal/user/otp.go issues the secure-session ID for only 10 minutes:

go func SetSecureSessionID(userId uint64) (sessionId string) { sessionId = uuid.NewString() cache.Set(secureSessionIDCacheKey(sessionId), userId, 10time.Minute) return }

The UI/server already rely on this boundary for sensitive actions. For example, api/config/router.go wraps config mutations with RequireSecureSession():

go o := r.Group("", middleware.RequireSecureSession()) { o.POST("configs", AddConfig) o.POST("config", EditConfig) o.POST("configmkdir", Mkdir) o.POST("configrename", Rename) o.POST("configdelete", DeleteConfig) }

api/sites/router.go protects normal site mutations:

go o := r.Group("", middleware.RequireSecureSession()) { o.POST("sites/:name/rename", RenameSite) o.POST("sites/:name/enable", EnableSite) o.POST("sites/:name/disable", DisableSite) o.POST("sites/:name", SaveSite) o.DELETE("sites/:name", DeleteSite) o.POST("sites/:name/duplicate", DuplicateSite) o.POST("sites/:name/maintenance", EnableMaintenanceSite) }

api/streams/router.go protects normal stream mutations, and api/settings/router.go protects secret reads/settings saves:

go o := r.Group("", middleware.RequireSecureSession()) { o.POST("streams/:name", SaveStream) o.POST("streams/:name/rename", RenameStream) o.POST("streams/:name/enable", EnableStream) o.POST("streams/:name/disable", DisableStream) o.DELETE("streams/:name", DeleteStream) o.POST("streams/:name/duplicate", Duplicate) }

go r.GET("settings/protected", middleware.RequireSecureSession(), GetProtectedSetting) r.POST("settings", middleware.RequireSecureSession(), SaveSettings)

The repository's own tests also verify this expected behavior. api/config/securitytest.go, api/sites/securitytest.go, and api/streams/securitytest.go each assert that OTP-enabled users receive 401 Unauthorized when protected mutations are attempted without a secure session.

Affected routes outside the step-up boundary

The affected routes are under the authenticated private router:

go g := root.Group("/", middleware.AuthRequired(), middleware.Proxy())

but they do not add middleware.RequireSecureSession().

Automatic backup management

api/backup/router.go protects manual restore:

go r.POST("/restore", middleware.AuthRequired(), middleware.RequireSecureSession(), middleware.EncryptedForm(), RestoreBackup)

but the automatic backup management router has no secure-session middleware:

go r.POST("/autobackup", CreateAutoBackup) r.POST("/autobackup/:id", ModifyAutoBackup) r.DELETE("/autobackup/:id", DestroyAutoBackup) r.PATCH("/autobackup/:id", RestoreAutoBackup) r.POST("/autobackup/tests3", TestS3Connection)

Those handlers create or modify backup jobs, register cron jobs, test attacker-supplied S3 settings, and store S3 credentials:

go "s3accesskeyid": "omitempty", "s3secretaccesskey": "omitempty", ... if ctx.Model.Enabled { if err := cron.AddAutoBackupJob(ctx.Model.ID, ctx.Model.CronExpression); err != nil {

The model stores S3 secret material:

go S3AccessKeyID string json:"s3accesskeyid" gorm:"comment:S3 access key ID;serializer:json[aes]" S3SecretAccessKey string json:"s3secretaccesskey" gorm:"comment:S3 secret access key;serializer:json[aes]"

Certificate, ACME, and DNS credential management

api/certificate/router.go registers credential and certificate mutations without RequireSecureSession():

go r.POST("dnscredentials", AddDnsCredential) r.POST("dnscredentials/:id", EditDnsCredential) r.DELETE("dnscredentials/:id", DeleteDnsCredential)

r.POST("certs", AddCert) r.POST("certs/:id", ModifyCert) r.DELETE("certs/:id", RemoveCert) r.PUT("certsync", SyncCertificate)

r.POST("acmeusers", CreateAcmeUser) r.POST("acmeusers/:id", ModifyAcmeUser) r.POST("acmeusers/:id/register", RegisterAcmeUser) r.DELETE("acmeusers/:id", DestroyAcmeUser)

The DNS credential handlers persist provider configuration:

go dnsCredential := model.DnsCredential{ Name: json.Name, Config: &json.Config, Provider: json.Provider, ProviderCode: providerCode, } ... err := d.Create(&dnsCredential)

The model serializes that configuration with AES:

go Config dns.Config json:"config,omitempty" gorm:"serializer:json[aes]"

DNS domains, records, and DDNS

api/dns/router.go registers DNS domain, record, and DDNS mutations without secure-session middleware:

go group.POST("/domains", CreateDomain) group.POST("/domains/:id", UpdateDomain) group.DELETE("/domains/:id", DeleteDomain) group.POST("/domains/:id/records", CreateRecord) group.PUT("/domains/:id/records/:recordid", UpdateRecord) group.DELETE("/domains/:id/records/:recordid", DeleteRecord) group.PUT("/domains/:id/ddns", UpdateDDNSConfig) group.DELETE("/domains/:id/ddns", DeleteDDNSConfig)

Those handlers call the DNS provider service and modify DDNS jobs:

go record, err := svc.CreateRecord(c.Request.Context(), domainID, toRecordInput(payload)) ... record, err := svc.UpdateRecord(c.Request.Context(), domainID, recordID, toRecordInput(payload)) ... if err := cron.AddOrUpdateDDNSJob(domainID, cfg.IntervalSeconds); err != nil {

Nginx control and configuration-side effects

api/nginx/router.go registers several server/Nginx mutation endpoints without RequireSecureSession():

go r.POST("nginx/reload", Reload) r.POST("nginx/restart", Restart) r.POST("nginx/stubstatus", ToggleStubStatus) r.POST("nginx/performance", UpdatePerformanceSettings) r.POST("nginx/modules/refresh", RefreshModulesCache)

The handlers perform control actions or persist Nginx-related changes:

go func Reload(c gin.Context) { nginx.Control(nginx.Reload).Resp(c) }

func Restart(c gin.Context) { c.JSON(http.StatusOK, gin.H{ "message": "ok", }) go nginx.Restart() }

go if json.Enable { err = performance.EnableStubStatus() } else { err = performance.DisableStubStatus() } ... reloadOutput, err := nginx.Reload()

go err := performance.UpdatePerfOpt(&perfOpt)

Site and stream advanced/batch mutations

api/sites/router.go leaves these site mutations before the secure-session group:

go r.PUT("sites", BatchUpdateSites) r.POST("sites/:name/advance", DomainEditByAdvancedMode) r.POST("autocert/:name", AddDomainToAutoCert) r.DELETE("autocert/:name", RemoveDomainFromAutoCert) r.POST("sitenavigation/order", UpdateSiteOrder) r.POST("sitenavigation/healthcheck/:id", UpdateHealthCheck)

DomainEditByAdvancedMode() persists the site's Advanced mode:

go , err = s.Where(s.Path.Eq(path)).Update(s.Advanced, json.Advanced)

AddDomainToAutoCert() writes certificate automation settings including DNS credential ID, domains, challenge method, and ACME user:

go err = certModel.Updates(&model.Cert{ Name: name, Domains: json.Domains, AutoCert: model.AutoCertEnabled, DnsCredentialID: json.DnsCredentialID, ChallengeMethod: json.ChallengeMethod, KeyType: helper.GetKeyType(json.KeyType), ACMEUserID: json.ACMEUserID, })

api/streams/router.go protects normal stream save/delete operations, but leaves batch update and advanced-mode outside:

go r.PUT("streams", BatchUpdateStreams) ... r.POST("streams/:name/advance", AdvancedEdit)

AdvancedEdit() persists the stream's Advanced mode:

go , err = s.Where(s.Path.Eq(path)).Update(s.Advanced, json.Advanced)

Safe local proof

I did not access any external Nginx UI deployment. The following proof only inspects the checked-out source tree and confirms that:

- RequireSecureSession() is a real OTP-gated 10-minute step-up mechanism; - high-risk control routes are intentionally protected elsewhere; - the affected route groups are authenticated but outside RequireSecureSession(); - the affected handlers perform persistent or server-control side effects.

Run:

bash python3 reports/nginx-ui-missing-secure-session-step-up-poc.py

Observed output:

json { "allaffectedgroupspresent": true, "allcontrolspresent": true, "allsideeffectspresent": true, "commit": "4948fba8744e82c3d7003f68ee164e9f49421066", "result": "VULNERABLESOURCECONFIRMED", "target": "0xJacky/nginx-ui" }

The full local proof output is available in my workspace as tmp/nginx-ui-missing-secure-session-step-up-poc-output.txt.

HTTP reproduction outline

This is a local-only reproduction outline for an isolated Nginx UI test instance, consistent with the project's security policy:

1. Create a test user with OTP enabled. 2. Log in as that user and keep only the normal authenticated session/JWT. 3. Do not obtain or send a fresh X-Secure-Session-ID. 4. Verify the expected protected control behavior:

http POST /api/config Authorization: <otp-user-session> Content-Type: application/json

{ "name": "example.conf", "content": "server { listen 80; }" }

Expected result: 401 Unauthorized because config edits require RequireSecureSession().

5. Attempt an affected operation with the same OTP-enabled session and no X-Secure-Session-ID, for example:

http POST /api/dnscredentials Authorization: <otp-user-session> Content-Type: application/json

{ "name": "attacker-controlled-test", "provider": "cloudflare", "providercode": "cloudflare", "token": "test-token" }

Expected secure behavior: 401 Unauthorized, matching the secure-session requirement for other sensitive configuration changes.

Actual behavior from source review: the request reaches AddDnsCredential() because the DNS credential router is under AuthRequired() but does not apply RequireSecureSession().

The same missing step-up applies to the other route groups listed above.

Impact

If an attacker obtains the authenticated web session/JWT for a 2FA-enabled Nginx UI user, the secure-session boundary should limit what they can do until they also pass a fresh OTP/passkey challenge. The current route map leaves major administrative actions outside that boundary.

Depending on the victim user's privileges and deployment configuration, this can allow the attacker to:

- add, edit, or remove DNS provider credentials; - alter certificate and ACME automation; - create, modify, delete, or restore automatic backup jobs; - configure S3 backup destinations and trigger S3 connection tests; - alter DNS domains, records, or DDNS schedules through configured providers; - restart or reload Nginx; - enable/disable stub-status and change performance settings; - switch sites/streams into advanced mode or change site automation bindings.

This undermines the value of the secure-session step-up for OTP-enabled accounts. I am not claiming pre-authentication access or remote code execution from this issue. The issue is missing step-up authorization for sensitive authenticated mutations.

Suggested fix

Recommended mitigation:

1. Apply middleware.RequireSecureSession() to all high-impact authenticated mutation routes that alter server, Nginx, certificate, DNS, backup, credential, or automation state. 2. At minimum, protect: - auto-backup create/modify/delete/restore/test-S3; - DNS credential create/edit/delete; - certificate and ACME user mutations; - DNS domain, record, and DDNS mutations; - Nginx reload/restart/stub-status/performance/module-cache mutation routes; - site/stream advanced-mode, batch, auto-cert, navigation order, and health-check mutations. 3. Add regression tests mirroring the existing config/site/stream security tests: - OTP-enabled user without X-Secure-Session-ID receives 401; - OTP-enabled user with a valid secure-session ID succeeds; - non-OTP users retain existing behavior if that is the intended product policy. 4. Consider centralizing "sensitive mutation" routing to make future omissions harder.