CVE-2024-49366 Nginx UI's json field can construct a directory traversal payload, causing arbitrary files to be written
HighCVSS 7.7
EPSS 0.60%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without verification, and can construct a value value in the form of ../../. Arbitrary files can be written to the server, which may result in loss of permissions. Version 2.0.0-beta.26 fixes the issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| 0xJacky nginx-ui | = < 2.0.0-beta.36 | No fix listed |
| nginxui nginx ui | < 2.0.0-beta.36 | 2.0.0-beta.36 |
| nginxui nginx ui | <= 1.9.9-4 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta1 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta10 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta10_patch | No fix listed |
| nginxui nginx ui | = 2.0.0-beta11 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta12 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta13 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta13-patch | No fix listed |
| nginxui nginx ui | = 2.0.0-beta14 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta15 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta16 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta17 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta18 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta18-patch1 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta18-patch2 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta19 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta2 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta20 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta21 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta22 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta23 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta23-patch1 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta23-ptach2 | No fix listed |
Show 26 more
| Product | Affected versions | Fixed in |
|---|---|---|
| nginxui nginx ui | = 2.0.0-beta24 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta25 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta25-patch1 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta25-ptach2 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta27 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta28 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta29 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta3 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta30 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta31 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta32 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta32-patch1 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta33 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta34 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta35 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta4 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta4_patch | No fix listed |
| nginxui nginx ui | = 2.0.0-beta5 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta5_patch | No fix listed |
| nginxui nginx ui | = 2.0.0-beta6 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta6_patch | No fix listed |
| nginxui nginx ui | = 2.0.0-beta6_patch2 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta7 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta8 | No fix listed |
| nginxui nginx ui | = 2.0.0-beta8_patch | No fix listed |
| nginxui nginx ui | = 2.0.0-beta9 | No fix listed |
References
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-prv4-rx44-f7jr exploit vendor-advisory
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.0-beta.36 release-notes