| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/0xJacky/Nginx-UI | ≤ 1.99all versions | |
| github.com/uozi-tech/cosy | < 1.30.1 | 1.30.1 |
| nginx ui | < 2.3.4 | 2.3.4 |
| cosy | < 1.30.1 | 1.30.1 |
The nginx-ui application is vulnerable to a Race Condition. Due to the complete absence of synchronization mechanisms (Mutex) and non-atomic file writes, concurrent requests lead to the severe corruption of the primary configuration file (app.ini). This vulnerability results in a persistent Denial of Service (DoS) and introduces a non-deterministic path for Remote Code Execution (RCE) through configuration cross-contamination.
The vulnerability exists because the settings update pipeline does not implement any synchronization primitives. When multiple requests reach the handler simultaneously:
ProtectedFill() modifies shared global singleton pointers without thread-safety, leading to inconsistent states in memory.gopkg.in/ini.v1) performs direct overwrites. Concurrent write operations interleave at the OS level, resulting in app.ini files with empty leading lines, truncated fields, or partially overwritten configuration keys./install) or encounters a fatal error during boot/runtime that prevents the process from responding to any further requests.Environment:
Check original app.ini file valid state:
<img width="524" height="367" alt="image" src="https://github.com/user-attachments/assets/d9688f76-7fe7-46ea-9eb9-c55bf40918a6" />Log in to the nginx-ui dashboard.
Navigate to Preferences and update settings. Capture a POST /api/settings request and send it to Burp Suite Intruder.
Configure the attack with Null payloads (to test basic concurrency) or a Fuzzing list (to test data-driven corruption).
Set the Resource Pool to 20-50 concurrent requests.
<img width="1188" height="776" alt="image" src="https://github.com/user-attachments/assets/403eef43-2bc6-4651-8802-15ddcb4f7631" />Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeObservation (In-flight corruption): Monitor the app.ini file. You will observe the file being written with empty leading lines or incomplete key-value pairs.
/install, attempting to complete the setup again often fails because the underlying configuration state is too corrupted to be reconciled by the installer logic.app.ini becomes so severe, the Go runtime or the INI parser encounters a fatal error, causing the Nginx-UI service to stop responding entirely (Hard DoS).Observation (Cross-Section Contamination): During testing, it was observed that sometimes INI sections become interleaved. For example, fields belonging to the [nginx] section (like ConfigDir or ReloadCmd) were erroneously written under the [webauthn] section.
Example of corrupted output observed:
[webauthn]
RPDisplayName =
RPID =
RPOrigins =
gDirWhiteList =
ConfigDir = /etc/nginx
ConfigPath =
PIDPath = /run/nginx.pid
SbinPath =
TestConfigCmd =
ReloadCmd = nginx -s reload
RestartCmd = nginx -s stop
StubStatusPort = 51820
ContainerName =
This is a High security risk (CWE-362: Race Condition).
ProtectedFill and settings.Save() calls in a sync.Mutex to serialize access to global settings.app.ini.tmp and use os.Rename() to replace the original file atomically, ensuring the configuration file is always in a valid state.A patched version of nginx-ui is available at https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4.