CVE-2024-49368

Nginx UI, a third-party web management interface for the Nginx web server, fails to validate the input supplied when configuring logrotate, passing it directly to exec.Command and enabling arbitrary command execution (CWE-20, improper input validation). An attacker who can reach an affected Nginx UI instance over the network can trigger the flaw via the logrotate configuration feature, with no privileges or user interaction required per the CVSS 4.0 scoring (AV:N/AC:L/PR:N/UI:N). Successful exploitation grants full command execution on the host running Nginx UI, with high impact on confidentiality, integrity, and availability (CVSS 4.0 score 8.9, High). All Nginx UI deployments running versions prior to 2.0.0-beta.36 are affected; Nginx itself is not affected. Exploitation is documented in a public GitHub security advisory (GHSA-66m6-27r9-77vm) with a proof of concept available; the flaw is not yet in CISA KEV, and EPSS assigns a 27.7% probability of exploitation within 30 days (98th percentile).

What to do: Upgrade Nginx UI to version 2.0.0-beta.36 or later. Until upgraded, restrict access to the Nginx UI interface (bind to localhost or place it behind a VPN/firewall or authenticated reverse proxy) and treat logrotate configuration entries as untrusted. Review logs and existing logrotate settings for signs of injected or unexpected commands indicating prior exploitation.