1. Summary
| Vulnerability Name |
nginxWebUI runCmd Remote Command Execution Vulnerability |
|---|---|
| Release Date |
June 29, 2023 |
| Component Name |
nginxWebUI runCmd |
| Affected Versions |
nginxWebUI ≤ 3.5.0 |
| Vulnerability Type |
Remote Command Execution Vulnerability |
2. About the Vulnerability
2.1 Introduction
The nginxWebUI is a configuration management tool for nginx, a web server that can also be used as a reverse proxy, load balancer, mail proxy, and HTTP cache. nginxWebUI allows users to configure various features of nginx in a graphical web interface, including HTTP forwarding, TCP forwarding, reverse proxy, load balancing, static HTML server, and automatic SSL certificate management. An nginx configuration file (nginx.conf) is generated to replace the default configuration file to apply the desired configurations.
2.2 Summary
On June 29, 2023, Sangfor FarSight Labs received a notice about a remote command execution vulnerability in nginxWebUI, classified as critical.
The vulnerability affects nginxWebUI’s runCmd feature and is caused by incomplete validation of user input. Attackers can exploit the vulnerability by crafting malicious data to execute arbitrary commands on a vulnerable server without authorization.
3. Affected Versions
nginxWebUI ≤ 3.5.0
4. Solutions
4.1 Remediation Solutions
4.1.1 Official Solution
Affected users can update to the latest version to fix the vulnerability. Link: https://www.nginxwebui.cn/
4.2 Sangfor Solution
4.2.1. Security Monitoring
The following Sangfor products and services perform real-time monitoring of assets affected by the nginxWebUI runCmd remote command execution vulnerability:
- Sangfor Cyber Command
- Sangfor Cyber Guardian Detection and Response Service
4.2.2 Security Protection
The following Sangfor products and services provide protection against the nginxWebUI runCmd remote command execution vulnerability:
- Sangfor Next Generation Application Firewall (NGAF)
- Sangfor Cyber Guardian Detection and Response Service
5. Timeline
On June 29, 2023, Sangfor FarSight Labs received a notice about the nginxWebUI runCmd remote command execution vulnerability.
On June 29, 2023, Sangfor FarSight Labs released a vulnerability alert with remediation solutions.
