CVE-2024-49366: Nginxui Path Traversal Vulnerability

CVE-2024-49366 Overview

CVE-2024-49366 is a path traversal vulnerability [CWE-22] in Nginx UI, a web interface for managing the Nginx web server. Versions 2.0.0-beta.35 and earlier accept JSON field values without validation, allowing attackers to inject ../../ traversal sequences. An attacker can write arbitrary files to locations outside the intended directory on the underlying server. This can corrupt application files, overwrite configuration, or compromise host permissions. The vendor addressed the issue in version 2.0.0-beta.36.

Critical Impact

Unauthenticated attackers can write arbitrary files to the host filesystem, leading to integrity loss and potential privilege compromise on systems running Nginx UI.

Affected Products

• Nginx UI versions up to and including 2.0.0-beta.35
• All 2.0.0 beta releases from beta1 through beta35, including intermediate patch builds
• Fixed in Nginx UI 2.0.0-beta.36

Discovery Timeline

• 2024-10-21 - CVE-2024-49366 published to NVD
• 2024-11-07 - Last updated in NVD database

Technical Details for CVE-2024-49366

Vulnerability Analysis

The vulnerability is a classic directory traversal flaw [CWE-22]. Nginx UI exposes API endpoints that accept JSON payloads describing file paths or names. The application reads these values directly from the JSON body and uses them in filesystem write operations without canonicalizing the path or rejecting traversal sequences.

Because the application runs with the privileges of the Nginx UI process, an attacker who supplies a value such as ../../etc/nginx/conf.d/malicious.conf can place attacker-controlled content in sensitive system locations. Overwriting Nginx configuration or scripts loaded by the host can lead to service hijacking, persistence, and lateral movement.

EPSS data places exploitation probability at 0.522% (percentile 67.189), indicating measurable interest relative to peer vulnerabilities.

Root Cause

The root cause is missing input validation on user-supplied JSON fields used as filesystem paths. The vulnerable code path retrieves the string value and concatenates it into a target write location without normalizing the path or restricting it to a permitted base directory. Sequences such as ../ are not stripped or rejected.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request containing a JSON body where a filename or path field includes traversal segments. The Nginx UI backend resolves the path relative to its working directory and writes attacker-supplied content to the resolved location. The attacker controls both the target path and the file contents, enabling arbitrary file write outside the intended directory.

No public proof-of-concept exploit code is referenced in vendor materials. Refer to the GitHub Security Advisory GHSA-prv4-rx44-f7jr for vendor details.

Detection Methods for CVE-2024-49366

Indicators of Compromise

• HTTP requests to Nginx UI API endpoints containing ../ or URL-encoded %2e%2e%2f sequences inside JSON body fields
• Unexpected new or modified files outside the Nginx UI working directory, particularly under /etc/nginx/, /etc/cron.d/, or user home directories
• Nginx UI process writing to filesystem paths that fall outside its documented data and configuration directories
• Configuration reloads or service restarts immediately following inbound requests to Nginx UI from untrusted sources

Detection Strategies

• Inspect Nginx UI access logs for POST or PUT requests whose JSON payloads contain traversal patterns in filename or path fields
• Deploy web application firewall rules that decode JSON bodies and reject requests containing .. segments in path-like parameters
• Use file integrity monitoring on /etc/nginx/ and adjacent directories to flag writes originating from the Nginx UI service account

Monitoring Recommendations

• Enable verbose request logging on Nginx UI and forward logs to a central platform for analysis
• Alert on filesystem writes performed by the Nginx UI process to paths outside its expected base directory
• Track outbound network connections from hosts running Nginx UI to detect post-exploitation activity following arbitrary file write

How to Mitigate CVE-2024-49366

Immediate Actions Required

• Upgrade Nginx UI to version 2.0.0-beta.36 or later, which addresses the path traversal flaw
• Restrict network access to the Nginx UI management interface so it is reachable only from trusted administrative networks
• Audit the Nginx UI host for unexpected files written outside the application's working directory since deployment
• Rotate any credentials, keys, or tokens stored on the host if compromise is suspected

Patch Information

The maintainers released a fix in Nginx UI v2.0.0-beta.36. The vendor advisory notes that version 2.0.0-beta.26 introduced the fix for the underlying issue; administrators should upgrade to the latest stable release rather than relying on an interim beta. Consult the GitHub Security Advisory GHSA-prv4-rx44-f7jr for the complete advisory text.

Workarounds

• Place Nginx UI behind a reverse proxy with strict allow-listing and authentication if immediate upgrade is not possible
• Run Nginx UI under a dedicated low-privilege user account with filesystem write permissions restricted to its working directory
• Apply mandatory access controls such as AppArmor or SELinux profiles that confine Nginx UI writes to approved paths

# Example: confine Nginx UI writes using a systemd unit override
# /etc/systemd/system/nginx-ui.service.d/hardening.conf
[Service]
ReadWritePaths=/var/lib/nginx-ui /etc/nginx/conf.d
ProtectSystem=strict
ProtectHome=true
NoNewPrivileges=true