CVE-2024-22198: Nginxui Nginx UI RCE Vulnerability

CVE-2024-22198 Overview

CVE-2024-22198 is a command injection vulnerability in Nginx-UI, a web interface for managing Nginx configurations. The flaw allows authenticated attackers to modify the Terminal Start Command setting through the API, even though the UI does not expose this field for editing. Successful exploitation results in arbitrary command execution on the underlying host, enabling remote code execution, privilege escalation, and information disclosure. The maintainers patched the issue in version 2.0.0.beta.9 by introducing protected settings fields. The vulnerability is tracked under [CWE-77: Improper Neutralization of Special Elements used in a Command].

Critical Impact
Authenticated attackers can execute arbitrary operating system commands as the Nginx-UI service account, leading to full host compromise.

Affected Products

Nginx-UI versions prior to 2.0.0.beta.9
Nginx-UI 2.0.0 beta1 through beta8 (including beta patch releases)
Deployments exposing the Nginx-UI settings API to authenticated users

Discovery Timeline

2024-01-11 - CVE-2024-22198 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22198

Vulnerability Analysis

Nginx-UI exposes application configuration through the Home > Preference page, backed by the /api/settings endpoints defined in api/system/settings.go. The settings structure includes fields such as Run Mode, Jwt Secret, Node Secret, and Terminal Start Command. The web frontend restricts editing of the Terminal Start Command field, but the backend SaveSettings handler does not enforce that restriction. An authenticated user can submit a crafted JSON payload directly to the API and overwrite the terminal command executed when a new PTY session is opened.

When a user subsequently launches the built-in web terminal, the internal/pty/pipeline.go logic spawns a process using the attacker-controlled command string. This provides a direct path from a low-privilege authenticated session to arbitrary command execution under the Nginx-UI process account, which frequently runs with elevated permissions to manage Nginx configurations and reload the service.

Root Cause

The root cause is missing access control on sensitive configuration fields. The Go structs backing ServerSettings and NginxSettings accepted client-supplied values for every JSON tag without marking security-relevant fields as read-only. Combined with the ability of the terminal subsystem to execute the stored command verbatim, this design allowed an attacker to convert a configuration write into command execution [CWE-77].

Attack Vector

An attacker requires valid authentication to Nginx-UI. They send a POST request to the settings API replacing the terminal_start_command value with an arbitrary shell command, then trigger a terminal session through the web interface. The injected command executes with the privileges of the Nginx-UI process.

// Security patch: api/system/settings.go and settings/nginx.go
// The fix adds a `protected:"true"` struct tag to sensitive fields
// and uses reflection to strip protected values from incoming save requests.

type Nginx struct {
    AccessLogPath string `json:"access_log_path"`
    ErrorLogPath  string `json:"error_log_path"`
    ConfigDir     string `json:"config_dir" protected:"true"`
    PIDPath       string `json:"pid_path" protected:"true"`
    TestConfigCmd string `json:"test_config_cmd" protected:"true"`
    ReloadCmd     string `json:"reload_cmd" protected:"true"`
    RestartCmd    string `json:"restart_cmd" protected:"true"`
}

// Source: https://github.com/0xJacky/nginx-ui/commit/827e76c46e63c52114a62a899f61313039c754e3

Detection Methods for CVE-2024-22198

Indicators of Compromise

POST or PATCH requests to Nginx-UI settings endpoints (for example /api/settings) containing keys such as terminal_start_command, reload_cmd, restart_cmd, or test_config_cmd.
Unexpected child processes spawned by the nginx-ui binary, particularly shells (/bin/sh, /bin/bash) or interpreters (python, perl, nc).
Modification timestamps on the Nginx-UI configuration file (app.ini) that do not correlate with legitimate administrative activity.

Detection Strategies

Alert on any HTTP request body sent to Nginx-UI settings APIs that includes start_cmd, terminal_start_command, or command-related JSON keys.
Monitor process ancestry to identify shells or scripting interpreters descending from the nginx-ui service, which is not expected during normal operation.
Correlate Nginx-UI authentication events with subsequent settings changes to identify low-privilege accounts modifying protected configuration values.

Monitoring Recommendations

Forward Nginx-UI application logs and system audit logs to a central SIEM for behavioral analysis and long-term retention.
Enable process execution auditing (auditd, execve) on hosts running Nginx-UI to capture command execution originating from the service.
Track outbound network connections from the Nginx-UI host to detect reverse shells or data exfiltration attempts following exploitation.

How to Mitigate CVE-2024-22198

Immediate Actions Required

Upgrade Nginx-UI to version 2.0.0.beta.9 or later, which introduces the protected:"true" field guard for sensitive settings.
Restrict network exposure of the Nginx-UI management interface to trusted administrative networks or VPN segments only.
Rotate the Jwt Secret and Node Secret values, and audit all Nginx-UI user accounts for unexpected credentials or privilege changes.

Patch Information

The fix is delivered in commit 827e76c46e63c52114a62a899f61313039c754e3, which annotates fields including ConfigDir, PIDPath, TestConfigCmd, ReloadCmd, and RestartCmd with the protected:"true" struct tag and uses reflection in SaveSettings to drop protected keys from incoming requests. Full details are available in the GitHub Security Advisory GHSA-8r25-68wm-jw35 and the upstream patch commit.

Workarounds

Place Nginx-UI behind a reverse proxy that enforces IP allowlisting and multi-factor authentication for the management path.
Run Nginx-UI as an unprivileged user with a restricted sudoers policy to limit the impact of command execution if the service is compromised.
Disable or firewall the built-in web terminal feature until the upgrade to 2.0.0.beta.9 or later is completed.

bash

# Upgrade Nginx-UI to the patched release
cd /path/to/nginx-ui
git fetch --all --tags
git checkout v2.0.0-beta.9

# Restart the service after upgrade
systemctl restart nginx-ui
systemctl status nginx-ui

# Restrict management interface exposure at the firewall
iptables -A INPUT -p tcp --dport 9000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP