Improper Input Validation (CWE-20)
Nginx UI, a web user interface for the Nginx web server, contains a vulnerability in versions prior to 2.0.0-beta.36. When Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, leading to arbitrary command execution.
This vulnerability allows an attacker to execute arbitrary commands on the system running Nginx UI. The impact is severe as it could lead to complete system compromise, including unauthorized access to sensitive data, modification of system configurations, and potential use of the compromised system as a launching point for further attacks. Given the network attack vector and the lack of required privileges or user interaction, this vulnerability could be exploited remotely, potentially affecting a large number of systems.
One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.
A patch is available. The vulnerability has been fixed in Nginx UI version 2.0.0-beta.36.
1. Update Nginx UI to version 2.0.0-beta.36 or later as soon as possible. 2. If immediate updating is not possible, consider temporarily disabling the logrotate configuration feature in Nginx UI until the update can be applied. 3. Implement network segmentation and access controls to limit exposure of the Nginx UI interface. 4. Monitor system logs for any suspicious activities or unauthorized command executions. 5. Regularly audit and review the Nginx UI configurations and associated systems for any signs of compromise.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD published the first details for CVE-2024-49368
Feedly found the first article mentioning CVE-2024-49368. See article
A CVSS base score of 8.9 has been assigned.
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.04% (Percentile: 9.7%)
A CVSS base score of 9.8 has been assigned.