CVE-2024-22198

Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings. The `Home > Preference` page exposes a list of system settings such as `Run Mode`, `Jwt Secret`, `Node Secret` and `Terminal Start Command`. While the UI doesn't allow users to modify the `Terminal Start Command` setting, it is possible to do so by sending a request to the API. This issue may lead to authenticated remote code execution, privilege escalation, and information disclosure. This vulnerability has been patched in version 2.0.0.beta.9.

• CWE-77

• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/api/system/settings.go#L18Product
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/api/terminal/pty.go#L11Product
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/internal/pty/pipeline.go#L29Product
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/router/middleware.go#L45Product
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/settings/server.go#L12Product
• https://github.com/0xJacky/nginx-ui/commit/827e76c46e63c52114a62a899f61313039c754e3Patch
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35Exploit, Vendor Advisory
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/api/system/settings.go#L18Product
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/api/terminal/pty.go#L11Product
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/internal/pty/pipeline.go#L29Product
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/router/middleware.go#L45Product
• https://github.com/0xJacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/settings/server.go#L12Product
• https://github.com/0xJacky/nginx-ui/commit/827e76c46e63c52114a62a899f61313039c754e3Patch
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35Exploit, Vendor Advisory

Published

Jan 11, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-22192Ursa is a cryptographic library for use with blockchains. Th…6.5
• CVE-2024-22193The vantage6 technology enables to manage and deploy privacy…4.3
• CVE-2024-22194cdo-local-uuid project provides a specialized UUID-generatin…2.8
• CVE-2024-22195Jinja is an extensible templating engine. Special placeholde…6.1
• CVE-2024-22196Nginx-UI is an online statistics for Server Indicators​​ Mon…6.5
• CVE-2024-22197Nginx-ui is online statistics for Server Indicators​​ Monito…8.8
• CVE-2024-22199This package provides universal methods to use multiple temp…6.1
• CVE-2024-2220The Button contact VR WordPress plugin through 4.7 does not …3.5
• CVE-2024-22200vantage6-UI is the User Interface for vantage6. The docker i…5.3
• CVE-2024-22201Jetty is a Java based web server and servlet engine. An HTTP…7.5
• CVE-2024-22202phpMyFAQ is an open source FAQ web application for PHP 8.1+ …6.5
• CVE-2024-22203Whoogle Search is a self-hosted metasearch engine. In versio…9.8