CVE-2024-22198: Nginx UI RCE Vulnerability

CVE-2024-22198 Overview

CVE-2024-22198 is a command injection vulnerability in Nginx-UI, a web-based management interface for Nginx configurations. The flaw allows authenticated attackers to abuse the settings API to modify the Terminal Start Command value, which the application later executes when a terminal session is opened. Although the web UI hides this field, the underlying API accepts modifications to it, enabling arbitrary operating system command execution on the host running Nginx-UI. Exploitation results in authenticated remote code execution, privilege escalation to the Nginx-UI process user, and information disclosure. The issue is tracked under CWE-77: Improper Neutralization of Special Elements used in a Command and was fixed in version 2.0.0.beta.9.

Critical Impact
Authenticated attackers can execute arbitrary OS commands on the Nginx-UI host by modifying protected settings through the API, leading to full host compromise.

Affected Products

Nginx-UI versions prior to 2.0.0.beta.9
Nginx-UI 2.0.0 beta1 through beta8 (including beta patches)
Deployments exposing the Nginx-UI Home > Preference API endpoint

Discovery Timeline

2024-01-11 - CVE-2024-22198 published to NVD
2024-01-11 - GitHub Security Advisory GHSA-8r25-68wm-jw35 published
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22198

Vulnerability Analysis

Nginx-UI exposes a settings API that returns and accepts updates to the full server configuration structure, including fields intended to be read-only. The Terminal Start Command setting defines the shell or program spawned when a user opens the built-in web terminal. While the front-end omits this field from the Home > Preference page, the backend SaveSettings handler accepts and persists any field posted to it. An authenticated user, including a low-privileged account, can send a crafted JSON request to overwrite Terminal Start Command with an arbitrary binary or shell command. When any user subsequently launches the terminal, Nginx-UI executes the attacker-supplied command with the privileges of the Nginx-UI process, typically root in containerized or systemd-managed deployments.

Root Cause

The root cause is missing server-side authorization on sensitive configuration fields. The original settings.go handler deserialized incoming JSON directly into the settings structs without distinguishing operator-modifiable fields from system-level fields such as Terminal Start Command, ConfigDir, PIDPath, TestConfigCmd, ReloadCmd, and RestartCmd. Any authenticated caller could therefore rewrite command paths executed by the server.

Attack Vector

An attacker with valid Nginx-UI credentials sends a POST request to the settings API, replacing the start_cmd value with an arbitrary command. On the next terminal invocation, the injected command executes on the host. The following patch from the vendor introduces a protected:"true" struct tag to prevent modification of these fields.

type Nginx struct {
    AccessLogPath string `json:"access_log_path"`
    ErrorLogPath  string `json:"error_log_path"`
    ConfigDir     string `json:"config_dir" protected:"true"`
    PIDPath       string `json:"pid_path" protected:"true"`
    TestConfigCmd string `json:"test_config_cmd" protected:"true"`
    ReloadCmd     string `json:"reload_cmd" protected:"true"`
    RestartCmd    string `json:"restart_cmd" protected:"true"`
}

var NginxSettings = Nginx{

Source: GitHub commit 827e76c

Detection Methods for CVE-2024-22198

Indicators of Compromise

Unexpected POST or PUT requests to the Nginx-UI /api/settings endpoint containing a start_cmd, reload_cmd, restart_cmd, or test_config_cmd field
Nginx-UI configuration files (typically app.ini or equivalent) showing non-default terminal or command values referencing shells, curl, wget, or bash -c
Child processes of the Nginx-UI binary that are not login, bash, or the expected shell used for the web terminal

Detection Strategies

Alert on any modification of the Nginx-UI settings file on disk outside of planned change windows
Inspect Nginx-UI HTTP access logs for authenticated requests writing to settings endpoints, correlated with subsequent terminal session opens
Monitor process ancestry for shells or scripting interpreters spawned by the Nginx-UI process with unusual command-line arguments

Monitoring Recommendations

Enable audit logging for all administrative API calls made against Nginx-UI and forward logs to a central SIEM
Baseline the expected Terminal Start Command value and alert on drift
Track authentication events and flag low-privileged accounts that access settings endpoints

How to Mitigate CVE-2024-22198

Immediate Actions Required

Upgrade Nginx-UI to version 2.0.0.beta.9 or later, which enforces protected:"true" on sensitive command fields
Rotate all Nginx-UI user credentials and JWT secrets after patching to invalidate any tokens issued to potentially compromised accounts
Review the current Terminal Start Command, ReloadCmd, RestartCmd, and TestConfigCmd values on every deployment and reset them to vendor defaults

Patch Information

The vendor fix is available in commit 827e76c and is included in Nginx-UI 2.0.0.beta.9. The patch adds a protected struct tag to command-related fields and updates the SaveSettings handler to use reflect to skip protected fields when applying incoming JSON. Details are documented in GHSA-8r25-68wm-jw35.

Workarounds

Restrict network access to the Nginx-UI web interface using firewall rules, VPN, or an authenticated reverse proxy so only trusted operators can reach the API
Run Nginx-UI as a low-privilege, non-root user inside an isolated container or sandbox to limit the impact of command execution
Disable or remove the built-in web terminal feature if it is not operationally required until the patch can be applied

bash

# Example: restrict Nginx-UI to localhost via reverse proxy and upgrade
sudo systemctl stop nginx-ui
# Download and install a patched release (>= 2.0.0.beta.9)
wget https://github.com/0xJacky/nginx-ui/releases/latest/download/nginx-ui-linux-amd64.tar.gz
tar -xzf nginx-ui-linux-amd64.tar.gz -C /usr/local/bin/
# Verify the terminal start command in app.ini is set to a safe default
grep -i start_cmd /usr/local/etc/nginx-ui/app.ini
sudo systemctl start nginx-ui