0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

go // api/cluster/node.go:19-48 func GetNode(c *gin.Context) { id := cast.ToUint64(c.Param("id"))

nodeQuery := query.Node

node, err := nodeQuery.FirstByID(id)
if err != nil {
	cosy.ErrHandler(c, err)
	return
}

c.JSON(http.StatusOK, analytic.GetNode(node))

}

func GetNodeList(c *gin.Context) { core := cosy.Coremodel.Node. SetFussy("name")

// fix for sqlite
if c.Query("enabled") != "" {
	core.GormScope(func(tx *gorm.DB) *gorm.DB {
		return tx.Where("enabled = ?", cast.ToInt(cast.ToBool(c.Query("enabled"))))
	})
}

core.SetTransformer(func(m *model.Node) any {
	return analytic.GetNode(m)
})

core.List()

} These handlers return node information directly to authenticated users. Because the returned object ultimately embeds the raw model.Node and that model contains a JSON token field, the API leaks the remote node shared secret.

go // model/node.go:8-13 type Node struct { Model Name string json:"name" URL string json:"url" Token string json:"token" Enabled bool json:"enabled" gorm:"default:false" } The model definition confirms that Token is JSON-serializable. This is a core part of the sensitive-information exposure because the field is not restricted to internal-only use.

go // internal/middleware/middleware.go:73-103 // getNodeSecret from header or query func getNodeSecret(c *gin.Context) (secret string) { if secret = c.GetHeader("X-Node-Secret"); secret != "" { return secret }

return c.Query("node_secret")

}

// AuthRequired is a middleware that checks if the user is authenticated func AuthRequired() gin.HandlerFunc { return func(c *gin.Context) { abortWithAuthFailure := func() { c.AbortWithStatusJSON(http.StatusForbidden, gin.H{ "message": "Authorization failed", }) }

	xNodeID := getXNodeID(c)
	if xNodeID != "" {
		c.Set("ProxyNodeID", xNodeID)
	}

	// Check node secret authentication
	if nodeSecret := getNodeSecret(c); nodeSecret != "" && nodeSecret == settings.NodeSettings.Secret {
		initUser := user.GetInitUser(c)
		c.Set("Secret", nodeSecret)
		c.Set("user", initUser)
		c.Next()
		return
	}

This authentication logic converts knowledge of the leaked node secret into an authenticated request as initUser. That makes the disclosed token immediately reusable for cross-node privilege escalation.

POC Prerequisites: (1) the attacker has a valid low-privileged user account, (2) at least one cluster node is configured, and (3) the target node management address is reachable from the current deployment, which is typical in clustered setups.

Reproduction steps:

Log in as a low-privileged user with POST /api/login using a request body containing name and password. Capture the returned JWT token. Request GET /api/nodes or GET /api/nodes/:id with the low-privileged user's Authorization token. Inspect the JSON response and extract the target node's url and token fields. The token is the shared secret accepted by the remote node as X-Node-Secret. Send a sensitive management request directly to the target node, such as POST /api/system/restart, with the leaked token in the X-Node-Secret header. If the target node returns 200 or an equivalent success response, the request has been accepted as trusted node traffic. Expected result: the attacker performs administrative actions on the remote node without possessing a legitimate high-privileged user session on that node, demonstrating cross-node authentication bypass and privilege escalation to initUser-level access.

Impact Any ordinary authenticated user can extract cluster node shared secrets and convert them into direct authentication bypass on remote nodes. The attacker can then execute high-risk administrative actions such as system restart, Nginx reload/restart, and configuration synchronization, enabling lateral movement across managed nodes and ultimately full compromise of the cluster management plane. The issue combines sensitive information disclosure with privilege escalation.

Remediation Do not return cluster node tokens in normal API responses. Use dedicated output DTOs for node APIs and fully redact or omit the token field. Require administrator-level authorization for node-management endpoints instead of exposing them to every authenticated user. X-Node-Secret should not be shared with the normal HTTP management plane; it should be restricted to controlled network paths or stronger node-to-node trust channels such as mutually authenticated connections. Even when node-secret authentication succeeds, its capabilities should be minimized rather than mapping directly to a general-purpose initUser identity.

Disclosure Notes The affected version is identified from the report-generation context as v2.4.2. No fixing commit, patched release, or vendor advisory was verified during this reporting stage, so patched_versions is marked as to be confirmed. The narrative below is based only on verified source-code evidence and the managed-vulnerability metadata.

Supplemental Information Affected products Ecosystem: self-hosted Package name: 0xJacky/nginx-ui Affected versions: v2.4.2 Patched versions: to be confirmed