{"items":[{"id":"NVI-00017590","kind":"vulnerability","title":"Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-pxmr-q2x3-9x9m","CVE-2024-22197"],"plain_summary":"GitHub lists this reviewed advisory for github.com/0xJacky/Nginx-UI. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-27e441928f9e4e43a1012403e80e8687"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-06T19:12:20.000Z","value":"7.7 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-27e441928f9e4e43a1012403e80e8687"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-27e441928f9e4e43a1012403e80e8687","url":"https://github.com/advisories/GHSA-pxmr-q2x3-9x9m","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-pxmr-q2x3-9x9m","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T23:36:01.427Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-27e441928f9e4e43a1012403e80e8687"],"technology":"github.com/0xJacky/Nginx-UI","known_exclusions":[],"conditions_summary":"### Summary\nThe `Home > Preference` page exposes a small list of nginx settings such as `Nginx Access Log Path` and `Nginx Error Log Path`. However, the API also exposes `test_config_cmd`, `reload_cmd` and `restart_cmd`. While the UI doesn't allow users to modify any of these settings, it is possible to do so by sending a request to the API.\n```go\nfunc InitPrivateRouter(r *gin.RouterGroup) {\n    r.GET(\"settings\", GetSettings)\n    r.POST(\"settings\", SaveSettings)\n    ...\n}\n```\nThe `SaveSettings` function is used to save the settings. It is protected by the `authRequired` middleware, which requires a valid JWT token or a `X-Node-Secret` which must equal the `Node Secret` configuration value. However, given the lack of authorization roles, any authenticated user can modify the settings.\nThe `SaveSettings` function is defined as follows:\n```go\nfunc SaveSetting","public_affected_ranges":["< 1.9.10-0.20231219184941-827e76c46e63"]}],"null_published_at":"2026-11-05T19:10:21.423Z","source_updated_at":"2026-07-06T19:12:20.000Z","source_disclosed_at":"2024-01-11T16:30:29.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T23:36:01.427Z"}],"next_cursor":null,"snapshot_revision":"42594"}