Remote Code Execution (RCE) Affecting github.com/0xjacky/nginx-ui/settings package, versions <2.0.0-beta.9
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.36% (73rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOM0XJACKYNGINXUISETTINGS-6156637
- published 14 Jan 2024
- disclosed 11 Jan 2024
- credit jorgectf
Introduced: 11 Jan 2024
CVE-2024-22198 Open this link in a new tabHow to fix?
Upgrade github.com/0xJacky/Nginx-UI/settings to version 2.0.0-beta.9 or higher.
Overview
github.com/0xJacky/Nginx-UI/settings is a yet another Nginx Web UI
Affected versions of this package are vulnerable to Remote Code Execution (RCE) on the Preference page, via the SaveSettings function, which can be triggered by any user. Such an an attacker can execute arbitrary commands and by crafting a malicious request to change the Terminal Start Command setting via API.
CVSS Scores
version 3.1