CVE-2024-22197: Nginxui Nginx UI RCE Vulnerability

CVE-2024-22197 Overview

CVE-2024-22197 is a command injection vulnerability [CWE-77] in Nginx-UI, an online monitoring interface for Nginx servers. The Home > Preference page exposes a limited set of Nginx configuration options through its API. However, the same API endpoint also accepts writes to sensitive fields including test_config_cmd, reload_cmd, and restart_cmd. Although the user interface does not surface these fields, authenticated attackers can modify them by crafting direct API requests. Successful exploitation results in authenticated remote code execution, privilege escalation, and information disclosure on the underlying host. The issue affects all Nginx-UI releases prior to 2.0.0.beta.9.

Critical Impact
Authenticated attackers can overwrite Nginx control commands through the settings API to execute arbitrary operating system commands with the privileges of the Nginx-UI process.

Affected Products

Nginx-UI versions prior to 2.0.0.beta.9
Nginx-UI 2.0.0 beta1 through beta8 (including patch releases)
Deployments where Nginx-UI manages Nginx service commands directly

Discovery Timeline

2024-01-11 - CVE-2024-22197 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22197

Vulnerability Analysis

Nginx-UI exposes server settings through a REST API backing the Home > Preference view. The GetSettings handler returns the full NginxSettings structure, and SaveSettings accepts writes to any field in that structure. Fields such as TestConfigCmd, ReloadCmd, and RestartCmd store shell commands that Nginx-UI later invokes to control the Nginx service. Because these fields lacked server-side protection, an authenticated user could replace them with arbitrary commands. The next reload or restart operation would then execute the attacker-supplied command in the context of the Nginx-UI process, which often runs with elevated privileges to manage Nginx.

Root Cause

The root cause is missing field-level access control on the settings serialization layer. The Nginx struct in settings/nginx.go treated administrative command fields as user-writable JSON properties. No protected tag or allow-list existed to prevent mass assignment from API input into command execution paths.

Attack Vector

An attacker with valid Nginx-UI credentials sends a POST request to the settings API containing a modified nginx object with a malicious test_config_cmd, reload_cmd, or restart_cmd value. When Nginx-UI subsequently tests, reloads, or restarts Nginx, the supplied command executes on the host. This turns any authenticated session, including low-privilege operator accounts, into a remote code execution primitive.

// Security patch in settings/nginx.go — adds `protected:"true"` tags
type Nginx struct {
    AccessLogPath string `json:"access_log_path"`
    ErrorLogPath  string `json:"error_log_path"`
    ConfigDir     string `json:"config_dir" protected:"true"`
    PIDPath       string `json:"pid_path" protected:"true"`
    TestConfigCmd string `json:"test_config_cmd" protected:"true"`
    ReloadCmd     string `json:"reload_cmd" protected:"true"`
    RestartCmd    string `json:"restart_cmd" protected:"true"`
}

var NginxSettings = Nginx{
// Source: https://github.com/0xJacky/nginx-ui/commit/827e76c46e63c52114a62a899f61313039c754e3

The patch introduces a protected:"true" struct tag on the command fields. The updated SaveSettings handler uses reflection to skip any field marked as protected, blocking mass-assignment attacks against command execution properties.

Detection Methods for CVE-2024-22197

Indicators of Compromise

Unexpected child processes spawned by the Nginx-UI binary, especially shells or interpreters such as /bin/sh, bash, python, or curl.
HTTP POST requests to the Nginx-UI settings API containing test_config_cmd, reload_cmd, or restart_cmd keys.
Modifications to Nginx-UI persistent configuration files where command fields differ from vendor defaults such as nginx -t, nginx -s reload, and nginx -s restart.

Detection Strategies

Inspect Nginx-UI access logs for authenticated POST requests targeting the settings endpoint and correlate with subsequent reload or restart calls.
Monitor process ancestry on hosts running Nginx-UI to identify command execution that does not match expected Nginx service management operations.
Deploy file integrity monitoring on the Nginx-UI configuration store to alert on out-of-band changes to command-related fields.

Monitoring Recommendations

Enable verbose audit logging for all Nginx-UI API mutations and forward events to a centralized logging platform for retention and correlation.
Baseline the expected command strings for test_config_cmd, reload_cmd, and restart_cmd, and alert on any deviation.
Track failed and successful authentication attempts against Nginx-UI to detect credential stuffing that precedes exploitation.

How to Mitigate CVE-2024-22197

Immediate Actions Required

Upgrade Nginx-UI to version 2.0.0.beta.9 or later, which enforces the protected field tag on command settings.
Rotate all Nginx-UI user credentials and any secrets accessible from the host if exploitation is suspected.
Restrict network access to the Nginx-UI management interface using firewall rules or a reverse proxy with source IP allow-listing.

Patch Information

The fix is delivered in commit 827e76c4 and documented in GitHub Security Advisory GHSA-pxmr-q2x3-9x9m. The patch adds protected:"true" struct tags to ConfigDir, PIDPath, TestConfigCmd, ReloadCmd, and RestartCmd, and updates SaveSettings to skip protected fields during deserialization using Go's reflect package.

Workarounds

Place Nginx-UI behind an authenticating reverse proxy and limit access to a small set of trusted administrators until patching is complete.
Run Nginx-UI under a dedicated, unprivileged service account with the minimum sudoers entries required to reload Nginx, reducing the blast radius of command injection.
Review persisted nginx settings and reset test_config_cmd, reload_cmd, and restart_cmd to vendor default values.

bash

# Upgrade Nginx-UI to the patched release
docker pull uozi/nginx-ui:latest
docker stop nginx-ui && docker rm nginx-ui
docker run -d --name nginx-ui \
  -v /etc/nginx:/etc/nginx \
  -v /etc/nginx-ui:/etc/nginx-ui \
  -p 127.0.0.1:9000:9000 \
  uozi/nginx-ui:latest

# Verify the running version is >= 2.0.0.beta.9
docker exec nginx-ui nginx-ui -v