Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operation on the base directory (/etc/nginx). In particular, this allows an authenticated user to remove the entire /etc/nginx directory, resulting in a partial Denial of Service. This issue has been patched in version 2.3.4.
| Vendor | Product | Versions |
|---|---|---|
| go | github.com/0xjacky/nginx-ui | go/github.com/0xJacky/Nginx-UI: <= 1.99 |
Updated severity to CRITICAL, marked as actively exploited, and specified patch available in version 2.3.4.
Initial creation
