Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.
The backup recovery mechanism in Nginx UI does not properly verify the integrity and authenticity of encrypted archives before processing them (CWE-347, CWE-354). An attacker with appropriate privilege level can modify the encrypted backup archive, and sensitive data contained in the backup may be stored in an insufficiently protected manner (CWE-312). After substituting the manipulated archive and restoring it, malicious configuration is injected into the Nginx environment.
An attacker can inject arbitrary Nginx configuration, which may lead to server takeover, breach of data confidentiality and integrity, and service disruption. High impact includes both local and system resources (CVSS SC:H, SI:H, SA:H).
Update Nginx UI to version 2.3.4 or newer, in which the vulnerability has been removed. Patch is available in the vendor references: https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4
Nginx UI in versions prior to 2.3.4
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNginxui nginx Ui
APPNginxui< 2.3.4
Related vulnerabilities
Nginx UI: nieuwierzytelnione RCE przez endpoint przywracania kopii zapasowej
Nginx UI: nieuwierzytelniony dostęp do endpointu MCP umożliwia przejęcie serwera
Nginx UI: nieuwierzytelniony dostęp do backupu z ujawnieniem kluczy szyfrowania
Nginx-UI: path traversal w imporcie certyfikatów umożliwia RCE
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can per...