### [CVE-2024-22198](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22198)
![](https://img.shields.io/static/v1?label=Product&message=nginx-ui&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%202.0.0.beta.9%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-77%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20a%20Command%20('Command%20Injection')&color=brighgreen)

### Description

Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings. The `Home > Preference` page exposes a list of system settings such as `Run Mode`, `Jwt Secret`, `Node Secret` and `Terminal Start Command`. While the UI doesn't allow users to modify the `Terminal Start Command` setting, it is possible to do so by sending a request to the API. This issue may lead to authenticated remote code execution, privilege escalation, and information disclosure. This vulnerability has been patched in version 2.0.0.beta.9.

### POC

#### Reference
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35

#### Github
No PoCs found on GitHub currently.