31911 matches found
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
Reporter: Jagadesh Achanta Target: 0xJacky/nginx-ui Affected version / commit tested: - App version: 2.3.10 - Commit: 4948fba8744e82c3d7003f68ee164e9f49421066 - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: cred:github-jagstack-gh-cli AI assistance disclosure...
GHSA-5V7C-XPFP-P65M Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
Reporter: Jagadesh Achanta Target: 0xJacky/nginx-ui Affected version / commit tested: - App version: 2.3.10 - Commit: 4948fba8744e82c3d7003f68ee164e9f49421066 - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: cred:github-jagstack-gh-cli AI assistance disclosure...
GHSA-2GC7-J998-5XX6 Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
Summary POST /api/users/:id allows any authenticated user to change any other user's password without RequireSecureSession 2FA verification. In contrast, the self password change endpoint POST /api/user/password correctly requires RequireSecureSession. This inconsistency enables any authenticated...
EUVD-2026-97862
Nginx UI: Account Takeover via Missing RequireSecureSession on User Management Endpoint...
Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
Summary POST /api/users/:id allows any authenticated user to change any other user's password without RequireSecureSession 2FA verification. In contrast, the self password change endpoint POST /api/user/password correctly requires RequireSecureSession. This inconsistency enables any authenticated...
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
Summary Endpoints that bind a TOTP secret POST /api/otpenroll or register a WebAuthn passkey POST /api/finishpasskeyregister for the current user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered outside the RequireSecureSession group. With...
EUVD-2026-97865
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover...
GHSA-GFRC-G87H-7H5W Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
Summary Endpoints that bind a TOTP secret POST /api/otpenroll or register a WebAuthn passkey POST /api/finishpasskeyregister for the current user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered outside the RequireSecureSession group. With...
EUVD-2026-97908
Nginx UI: MCP nginxconfigadd Bypasses Directive Validation — Authenticated RCE...
Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
Summary The MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that function and correctly rejects dangerous directives. An authenticated attacker c...
GHSA-9JWW-CXG5-RJ9M Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
Summary The MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that function and correctly rejects dangerous directives. An authenticated attacker c...
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
Summary internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and...
EUVD-2026-97895
Nginx UI: MCP nginxconfigadd skips config directive validation → authenticated nginx directive injection RCE on the official image...
GHSA-76PM-MQ2Q-9GCR Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
Summary internal/config/validation.go ValidateConfigFile is a security control that blocks dangerous nginx directives — js, perl, loadmodule of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and...
Nginx UI: Auto backup name allows path traversal outside validated storage path
Summary Nginx UI validates backuppath and storagepath against the administrator-defined backup.GrantedAccessPath boundary, but the final auto-backup output filename is built from the user-controlled auto-backup name without stripping path separators or .. components. An authenticated user who can...
EUVD-2026-97860
Nginx UI: Auto backup name allows path traversal outside validated storage path...
GHSA-JRQ7-XRJX-PCFW Nginx UI: Auto backup name allows path traversal outside validated storage path
Summary Nginx UI validates backuppath and storagepath against the administrator-defined backup.GrantedAccessPath boundary, but the final auto-backup output filename is built from the user-controlled auto-backup name without stripping path separators or .. components. An authenticated user who can...
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
Summary The regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the...
GHSA-5R62-GJ48-897X Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
Summary The regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the...