Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.
Affected: Go: github.com/0xJacky/Nginx-UI
## Summary
The `/api/backup` endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the `X-Backup-Security` response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately.
## Vulnerability Details
| Field | Value | |-------|-------| | CWE | CWE-306: Missing Authentication for Critical Function + CWE-311: Missing Encryption of Sensitive Data | | Affected File | `api/backup/router.go` | | Affected Function | `CreateBackup` (lines 8-11 in router, implementation in `api/backup/backup.go:13-38`) | | Secondary File | `internal/backup/backup.go` | | CVSS 3.1 | 9.8 (Critical) | | CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
## Root Cause
The vulnerability exists due to two critical security flaws:
### 1. Missing Authentication on /api/backup Endpoint
In `api/backup/router.go:9`, the backup endpoint is registered without any authentication middleware:
```go func InitRouter(r *gin.RouterGroup) { r.GET("/backup", CreateBackup) // No authentication required r.POST("/restore", middleware.EncryptedForm(), RestoreBackup) // Has middleware } ```
For comparison, the restore endpoint correctly uses middleware, while the backup endpoint is completely open.
### 2. Encryption Keys Disclosed in HTTP Response Headers
In `api/backup/backup.go:22-33`, the AES…
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in nginx-ui ausnutzen, um Sicherheitsvorkehrungen zu umgehen und so eine vollständige Systembackup mit sensiblen Daten offenzulegen und zu entschlüsseln.