Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.
Affected: Go: github.com/0xJacky/Nginx-UI
## Summary
The regular HTTP configuration API rejects restricted Nginx directives such as `load_module`, `js_import`, and `js_content`.
However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the user to load `ngx_http_js_module.so`, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context.
This is authenticated and is not OS command execution by itself.
## Affected component
- `/mcp` - `/mcp_message` - MCP tool: `nginx_config_add` - Nginx configuration validation
## Impact
A secondary authenticated user can bypass the restricted directive validation enforced by the HTTP API and execute attacker-controlled NJS inside the Nginx worker context.
This may allow modification of Nginx runtime behavior, including responses, routing, headers, redirects, and request handling.
## Minimal PoC
### Preconditions
- Attacker has a secondary authenticated Nginx UI account. - MCP is enabled. - Nginx has NJS available:
```bash find / -name "ngx_http_js_module.so" 2>/dev/null ```
Observed in the lab:
```text /usr/lib/nginx/modules/ngx_http_js_module.so ```
### 1. HTTP API blocks the restricted config
Request:
```http POST /api/configs Authorization: <SECONDARY_USER_JWT> Content-Type: application/json ```
Body:
```json { "name": "nginx.conf", "base_dir": "", "overwrite": true, "sync_node_ids": [], "content": "load_module…