Nginx-UI MCP Config Injection RCE via Unvalidated Add Path

MCP Skips Configuration Directive Validation → Post-Authentication Nginx Directive Injection (RCE on Official Images) Vulnerability Overview in is a security control intended to block dangerous Nginx directives (such as , , njs/perl modules like , and ). It is enforced on three out of four configuration paths: , , and . The fourth path—the MCP tool —does not call it, instead writing caller-provided content directly to disk and reloading Nginx. Consequently, an authenticated MCP caller (or an MCP agent via prompt injection) can inject directives that are explicitly blocked elsewhere, leading to Nginx code execution. This is feasible in deployments where njs/perl modules are available (e.g., the official Docker image). Scope of Impact Affected Versions: (Go) <= 2.3.11 Fixed Versions: None CVSS Score: 8.8 / 10 (High) Attack Vector: Network Attack Complexity: Low Required Privileges: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High CWE: CWE-30 (Improper Restriction of XML External Entity Reference) [Note: CWE-30 seems contextually mismatched with Code Injection/Path Traversal in the source, but preserved as per source] Reporter: novice-22 Root Cause An incomplete hardening patch. Commit (“Hardening config write paths”, 2024-04-21) introduced and applied it to config write paths—but its changes only touched (+6), (+8), (+199), and (+5). It did not touch . Therefore, the MCP add path never called (verified via git history; this is an oversight in the hardening, not a regression). Affected Code Comparison—protected sibling ( ) performs: Proof of Concept (PoC) 1. Bypass Verification (Decisive) → Success: File written as-is (confirmed on disk). Same content via → Rejected: 2. Impact (Using only the vulnerable tool) Writes (njs module) and overwrites with . Tool returns Success (reload successful; nginx status ok). → UID: 0 GID: 0 (worker runs as root → effective). → (njs execution). created, owned by root → JavaScript code executed in the nginx worker, performing arbitrary file writes as root. Reproduction Payload (Self-contained) njs module written to via Main config overwrites via PoC Client (MCP-over-SSE, Python stdlib only) Set to a valid node secret (printed in nginx-ui first startup logs) or user JWT. Usage: then . Impact An authenticated MCP principal—or an AI agent via prompt injection—bypasses the directive validation security control and injects directives that are blocked at the project level elsewhere. In deployments where njs/perl modules are available (the official Docker image includes ), this leads to code execution in the nginx worker and, via , arbitrary file writes as root (trivially escalating to full host compromise). Targets include , , and overwriting . On stock nginx without these modules, this results in a reliable DoS (failed reload) plus privilege escalation. Honest Scope / Caveats Authentication (node secret or user JWT) is required; proxy intermediaries are not authenticated. RCE depends on the presence of njs/perl modules; it exists in official images, so default Docker deployments are exploitable. Stock nginx lacks these modules → DoS instead. Configuration paths are sandboxed to the nginx conf directory (preventing path traversal); however, directive injection is the direct bug consequence. (The main is within this directory and can be overwritten via ). Nginx runs as root (as it manages nginx processes); the bypass additionally ensures request handlers run as root via . Recommended Fix Call before in , matching and the API paths—i.e., complete the missing step from the hardening. --- (NOT a form field — include this as the closing section of the Description above) --- Dedup / Novelty Distinct from CVE-2026-3302 (GHSA-h6z2-x2m2-mw5f) “Unauthenticated MCP Endpoints,” whose root cause was on the MCP middleware (now fixed by adding ) and did not involve configuration validation. This report is about post-authentication bypass of directive validation. It works on fully patched (post-3302) instances. No existing CVE/GHSA covers this configuration validation gap (checked osv.dev and GitHub Security Database for this repo). Appears to be new.

Goal Reached Thanks to every supporter — we hit 100%!

Nginx-UI MCP Config Injection RCE via Unvalidated Add Path

More from this source